1 /* 2 * Copyright (c) 2007-2009 Patrick McHardy <kaber@trash.net> 3 * 4 * This program is free software; you can redistribute it and/or modify 5 * it under the terms of the GNU General Public License version 2 as 6 * published by the Free Software Foundation. 7 * 8 * Development of this code funded by Astaro AG (http://www.astaro.com/) 9 */ 10 11 #include <linux/module.h> 12 #include <linux/init.h> 13 #include <linux/list.h> 14 #include <linux/skbuff.h> 15 #include <linux/netlink.h> 16 #include <linux/netfilter.h> 17 #include <linux/netfilter/nfnetlink.h> 18 #include <linux/netfilter/nf_tables.h> 19 #include <net/netfilter/nf_tables_core.h> 20 #include <net/netfilter/nf_tables.h> 21 #include <net/net_namespace.h> 22 #include <net/sock.h> 23 24 static LIST_HEAD(nf_tables_expressions); 25 26 /** 27 * nft_register_afinfo - register nf_tables address family info 28 * 29 * @afi: address family info to register 30 * 31 * Register the address family for use with nf_tables. Returns zero on 32 * success or a negative errno code otherwise. 33 */ 34 int nft_register_afinfo(struct net *net, struct nft_af_info *afi) 35 { 36 INIT_LIST_HEAD(&afi->tables); 37 nfnl_lock(NFNL_SUBSYS_NFTABLES); 38 list_add_tail_rcu(&afi->list, &net->nft.af_info); 39 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 40 return 0; 41 } 42 EXPORT_SYMBOL_GPL(nft_register_afinfo); 43 44 /** 45 * nft_unregister_afinfo - unregister nf_tables address family info 46 * 47 * @afi: address family info to unregister 48 * 49 * Unregister the address family for use with nf_tables. 50 */ 51 void nft_unregister_afinfo(struct nft_af_info *afi) 52 { 53 nfnl_lock(NFNL_SUBSYS_NFTABLES); 54 list_del_rcu(&afi->list); 55 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 56 } 57 EXPORT_SYMBOL_GPL(nft_unregister_afinfo); 58 59 static struct nft_af_info *nft_afinfo_lookup(struct net *net, int family) 60 { 61 struct nft_af_info *afi; 62 63 list_for_each_entry(afi, &net->nft.af_info, list) { 64 if (afi->family == family) 65 return afi; 66 } 67 return NULL; 68 } 69 70 static struct nft_af_info * 71 nf_tables_afinfo_lookup(struct net *net, int family, bool autoload) 72 { 73 struct nft_af_info *afi; 74 75 afi = nft_afinfo_lookup(net, family); 76 if (afi != NULL) 77 return afi; 78 #ifdef CONFIG_MODULES 79 if (autoload) { 80 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 81 request_module("nft-afinfo-%u", family); 82 nfnl_lock(NFNL_SUBSYS_NFTABLES); 83 afi = nft_afinfo_lookup(net, family); 84 if (afi != NULL) 85 return ERR_PTR(-EAGAIN); 86 } 87 #endif 88 return ERR_PTR(-EAFNOSUPPORT); 89 } 90 91 static void nft_ctx_init(struct nft_ctx *ctx, 92 const struct sk_buff *skb, 93 const struct nlmsghdr *nlh, 94 struct nft_af_info *afi, 95 struct nft_table *table, 96 struct nft_chain *chain, 97 const struct nlattr * const *nla) 98 { 99 ctx->net = sock_net(skb->sk); 100 ctx->afi = afi; 101 ctx->table = table; 102 ctx->chain = chain; 103 ctx->nla = nla; 104 ctx->portid = NETLINK_CB(skb).portid; 105 ctx->report = nlmsg_report(nlh); 106 ctx->seq = nlh->nlmsg_seq; 107 } 108 109 static struct nft_trans *nft_trans_alloc(struct nft_ctx *ctx, int msg_type, 110 u32 size) 111 { 112 struct nft_trans *trans; 113 114 trans = kzalloc(sizeof(struct nft_trans) + size, GFP_KERNEL); 115 if (trans == NULL) 116 return NULL; 117 118 trans->msg_type = msg_type; 119 trans->ctx = *ctx; 120 121 return trans; 122 } 123 124 static void nft_trans_destroy(struct nft_trans *trans) 125 { 126 list_del(&trans->list); 127 kfree(trans); 128 } 129 130 int nft_register_basechain(struct nft_base_chain *basechain, 131 unsigned int hook_nops) 132 { 133 struct net *net = read_pnet(&basechain->pnet); 134 135 if (basechain->flags & NFT_BASECHAIN_DISABLED) 136 return 0; 137 138 return nf_register_net_hooks(net, basechain->ops, hook_nops); 139 } 140 EXPORT_SYMBOL_GPL(nft_register_basechain); 141 142 void nft_unregister_basechain(struct nft_base_chain *basechain, 143 unsigned int hook_nops) 144 { 145 struct net *net = read_pnet(&basechain->pnet); 146 147 if (basechain->flags & NFT_BASECHAIN_DISABLED) 148 return; 149 150 nf_unregister_net_hooks(net, basechain->ops, hook_nops); 151 } 152 EXPORT_SYMBOL_GPL(nft_unregister_basechain); 153 154 static int nf_tables_register_hooks(const struct nft_table *table, 155 struct nft_chain *chain, 156 unsigned int hook_nops) 157 { 158 if (table->flags & NFT_TABLE_F_DORMANT || 159 !(chain->flags & NFT_BASE_CHAIN)) 160 return 0; 161 162 return nft_register_basechain(nft_base_chain(chain), hook_nops); 163 } 164 165 static void nf_tables_unregister_hooks(const struct nft_table *table, 166 struct nft_chain *chain, 167 unsigned int hook_nops) 168 { 169 if (table->flags & NFT_TABLE_F_DORMANT || 170 !(chain->flags & NFT_BASE_CHAIN)) 171 return; 172 173 nft_unregister_basechain(nft_base_chain(chain), hook_nops); 174 } 175 176 /* Internal table flags */ 177 #define NFT_TABLE_INACTIVE (1 << 15) 178 179 static int nft_trans_table_add(struct nft_ctx *ctx, int msg_type) 180 { 181 struct nft_trans *trans; 182 183 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_table)); 184 if (trans == NULL) 185 return -ENOMEM; 186 187 if (msg_type == NFT_MSG_NEWTABLE) 188 ctx->table->flags |= NFT_TABLE_INACTIVE; 189 190 list_add_tail(&trans->list, &ctx->net->nft.commit_list); 191 return 0; 192 } 193 194 static int nft_deltable(struct nft_ctx *ctx) 195 { 196 int err; 197 198 err = nft_trans_table_add(ctx, NFT_MSG_DELTABLE); 199 if (err < 0) 200 return err; 201 202 list_del_rcu(&ctx->table->list); 203 return err; 204 } 205 206 static int nft_trans_chain_add(struct nft_ctx *ctx, int msg_type) 207 { 208 struct nft_trans *trans; 209 210 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_chain)); 211 if (trans == NULL) 212 return -ENOMEM; 213 214 if (msg_type == NFT_MSG_NEWCHAIN) 215 ctx->chain->flags |= NFT_CHAIN_INACTIVE; 216 217 list_add_tail(&trans->list, &ctx->net->nft.commit_list); 218 return 0; 219 } 220 221 static int nft_delchain(struct nft_ctx *ctx) 222 { 223 int err; 224 225 err = nft_trans_chain_add(ctx, NFT_MSG_DELCHAIN); 226 if (err < 0) 227 return err; 228 229 ctx->table->use--; 230 list_del_rcu(&ctx->chain->list); 231 232 return err; 233 } 234 235 static inline bool 236 nft_rule_is_active(struct net *net, const struct nft_rule *rule) 237 { 238 return (rule->genmask & nft_genmask_cur(net)) == 0; 239 } 240 241 static inline int 242 nft_rule_is_active_next(struct net *net, const struct nft_rule *rule) 243 { 244 return (rule->genmask & nft_genmask_next(net)) == 0; 245 } 246 247 static inline void 248 nft_rule_activate_next(struct net *net, struct nft_rule *rule) 249 { 250 /* Now inactive, will be active in the future */ 251 rule->genmask = nft_genmask_cur(net); 252 } 253 254 static inline void 255 nft_rule_deactivate_next(struct net *net, struct nft_rule *rule) 256 { 257 rule->genmask = nft_genmask_next(net); 258 } 259 260 static inline void nft_rule_clear(struct net *net, struct nft_rule *rule) 261 { 262 rule->genmask &= ~nft_genmask_next(net); 263 } 264 265 static int 266 nf_tables_delrule_deactivate(struct nft_ctx *ctx, struct nft_rule *rule) 267 { 268 /* You cannot delete the same rule twice */ 269 if (nft_rule_is_active_next(ctx->net, rule)) { 270 nft_rule_deactivate_next(ctx->net, rule); 271 ctx->chain->use--; 272 return 0; 273 } 274 return -ENOENT; 275 } 276 277 static struct nft_trans *nft_trans_rule_add(struct nft_ctx *ctx, int msg_type, 278 struct nft_rule *rule) 279 { 280 struct nft_trans *trans; 281 282 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_rule)); 283 if (trans == NULL) 284 return NULL; 285 286 nft_trans_rule(trans) = rule; 287 list_add_tail(&trans->list, &ctx->net->nft.commit_list); 288 289 return trans; 290 } 291 292 static int nft_delrule(struct nft_ctx *ctx, struct nft_rule *rule) 293 { 294 struct nft_trans *trans; 295 int err; 296 297 trans = nft_trans_rule_add(ctx, NFT_MSG_DELRULE, rule); 298 if (trans == NULL) 299 return -ENOMEM; 300 301 err = nf_tables_delrule_deactivate(ctx, rule); 302 if (err < 0) { 303 nft_trans_destroy(trans); 304 return err; 305 } 306 307 return 0; 308 } 309 310 static int nft_delrule_by_chain(struct nft_ctx *ctx) 311 { 312 struct nft_rule *rule; 313 int err; 314 315 list_for_each_entry(rule, &ctx->chain->rules, list) { 316 err = nft_delrule(ctx, rule); 317 if (err < 0) 318 return err; 319 } 320 return 0; 321 } 322 323 /* Internal set flag */ 324 #define NFT_SET_INACTIVE (1 << 15) 325 326 static int nft_trans_set_add(struct nft_ctx *ctx, int msg_type, 327 struct nft_set *set) 328 { 329 struct nft_trans *trans; 330 331 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_set)); 332 if (trans == NULL) 333 return -ENOMEM; 334 335 if (msg_type == NFT_MSG_NEWSET && ctx->nla[NFTA_SET_ID] != NULL) { 336 nft_trans_set_id(trans) = 337 ntohl(nla_get_be32(ctx->nla[NFTA_SET_ID])); 338 set->flags |= NFT_SET_INACTIVE; 339 } 340 nft_trans_set(trans) = set; 341 list_add_tail(&trans->list, &ctx->net->nft.commit_list); 342 343 return 0; 344 } 345 346 static int nft_delset(struct nft_ctx *ctx, struct nft_set *set) 347 { 348 int err; 349 350 err = nft_trans_set_add(ctx, NFT_MSG_DELSET, set); 351 if (err < 0) 352 return err; 353 354 list_del_rcu(&set->list); 355 ctx->table->use--; 356 357 return err; 358 } 359 360 /* 361 * Tables 362 */ 363 364 static struct nft_table *nft_table_lookup(const struct nft_af_info *afi, 365 const struct nlattr *nla) 366 { 367 struct nft_table *table; 368 369 list_for_each_entry(table, &afi->tables, list) { 370 if (!nla_strcmp(nla, table->name)) 371 return table; 372 } 373 return NULL; 374 } 375 376 static struct nft_table *nf_tables_table_lookup(const struct nft_af_info *afi, 377 const struct nlattr *nla) 378 { 379 struct nft_table *table; 380 381 if (nla == NULL) 382 return ERR_PTR(-EINVAL); 383 384 table = nft_table_lookup(afi, nla); 385 if (table != NULL) 386 return table; 387 388 return ERR_PTR(-ENOENT); 389 } 390 391 static inline u64 nf_tables_alloc_handle(struct nft_table *table) 392 { 393 return ++table->hgenerator; 394 } 395 396 static const struct nf_chain_type *chain_type[AF_MAX][NFT_CHAIN_T_MAX]; 397 398 static const struct nf_chain_type * 399 __nf_tables_chain_type_lookup(int family, const struct nlattr *nla) 400 { 401 int i; 402 403 for (i = 0; i < NFT_CHAIN_T_MAX; i++) { 404 if (chain_type[family][i] != NULL && 405 !nla_strcmp(nla, chain_type[family][i]->name)) 406 return chain_type[family][i]; 407 } 408 return NULL; 409 } 410 411 static const struct nf_chain_type * 412 nf_tables_chain_type_lookup(const struct nft_af_info *afi, 413 const struct nlattr *nla, 414 bool autoload) 415 { 416 const struct nf_chain_type *type; 417 418 type = __nf_tables_chain_type_lookup(afi->family, nla); 419 if (type != NULL) 420 return type; 421 #ifdef CONFIG_MODULES 422 if (autoload) { 423 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 424 request_module("nft-chain-%u-%.*s", afi->family, 425 nla_len(nla), (const char *)nla_data(nla)); 426 nfnl_lock(NFNL_SUBSYS_NFTABLES); 427 type = __nf_tables_chain_type_lookup(afi->family, nla); 428 if (type != NULL) 429 return ERR_PTR(-EAGAIN); 430 } 431 #endif 432 return ERR_PTR(-ENOENT); 433 } 434 435 static const struct nla_policy nft_table_policy[NFTA_TABLE_MAX + 1] = { 436 [NFTA_TABLE_NAME] = { .type = NLA_STRING, 437 .len = NFT_TABLE_MAXNAMELEN - 1 }, 438 [NFTA_TABLE_FLAGS] = { .type = NLA_U32 }, 439 }; 440 441 static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net, 442 u32 portid, u32 seq, int event, u32 flags, 443 int family, const struct nft_table *table) 444 { 445 struct nlmsghdr *nlh; 446 struct nfgenmsg *nfmsg; 447 448 event |= NFNL_SUBSYS_NFTABLES << 8; 449 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags); 450 if (nlh == NULL) 451 goto nla_put_failure; 452 453 nfmsg = nlmsg_data(nlh); 454 nfmsg->nfgen_family = family; 455 nfmsg->version = NFNETLINK_V0; 456 nfmsg->res_id = htons(net->nft.base_seq & 0xffff); 457 458 if (nla_put_string(skb, NFTA_TABLE_NAME, table->name) || 459 nla_put_be32(skb, NFTA_TABLE_FLAGS, htonl(table->flags)) || 460 nla_put_be32(skb, NFTA_TABLE_USE, htonl(table->use))) 461 goto nla_put_failure; 462 463 nlmsg_end(skb, nlh); 464 return 0; 465 466 nla_put_failure: 467 nlmsg_trim(skb, nlh); 468 return -1; 469 } 470 471 static int nf_tables_table_notify(const struct nft_ctx *ctx, int event) 472 { 473 struct sk_buff *skb; 474 int err; 475 476 if (!ctx->report && 477 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) 478 return 0; 479 480 err = -ENOBUFS; 481 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 482 if (skb == NULL) 483 goto err; 484 485 err = nf_tables_fill_table_info(skb, ctx->net, ctx->portid, ctx->seq, 486 event, 0, ctx->afi->family, ctx->table); 487 if (err < 0) { 488 kfree_skb(skb); 489 goto err; 490 } 491 492 err = nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES, 493 ctx->report, GFP_KERNEL); 494 err: 495 if (err < 0) { 496 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, 497 err); 498 } 499 return err; 500 } 501 502 static int nf_tables_dump_tables(struct sk_buff *skb, 503 struct netlink_callback *cb) 504 { 505 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); 506 const struct nft_af_info *afi; 507 const struct nft_table *table; 508 unsigned int idx = 0, s_idx = cb->args[0]; 509 struct net *net = sock_net(skb->sk); 510 int family = nfmsg->nfgen_family; 511 512 rcu_read_lock(); 513 cb->seq = net->nft.base_seq; 514 515 list_for_each_entry_rcu(afi, &net->nft.af_info, list) { 516 if (family != NFPROTO_UNSPEC && family != afi->family) 517 continue; 518 519 list_for_each_entry_rcu(table, &afi->tables, list) { 520 if (idx < s_idx) 521 goto cont; 522 if (idx > s_idx) 523 memset(&cb->args[1], 0, 524 sizeof(cb->args) - sizeof(cb->args[0])); 525 if (nf_tables_fill_table_info(skb, net, 526 NETLINK_CB(cb->skb).portid, 527 cb->nlh->nlmsg_seq, 528 NFT_MSG_NEWTABLE, 529 NLM_F_MULTI, 530 afi->family, table) < 0) 531 goto done; 532 533 nl_dump_check_consistent(cb, nlmsg_hdr(skb)); 534 cont: 535 idx++; 536 } 537 } 538 done: 539 rcu_read_unlock(); 540 cb->args[0] = idx; 541 return skb->len; 542 } 543 544 static int nf_tables_gettable(struct sock *nlsk, struct sk_buff *skb, 545 const struct nlmsghdr *nlh, 546 const struct nlattr * const nla[]) 547 { 548 const struct nfgenmsg *nfmsg = nlmsg_data(nlh); 549 const struct nft_af_info *afi; 550 const struct nft_table *table; 551 struct sk_buff *skb2; 552 struct net *net = sock_net(skb->sk); 553 int family = nfmsg->nfgen_family; 554 int err; 555 556 if (nlh->nlmsg_flags & NLM_F_DUMP) { 557 struct netlink_dump_control c = { 558 .dump = nf_tables_dump_tables, 559 }; 560 return netlink_dump_start(nlsk, skb, nlh, &c); 561 } 562 563 afi = nf_tables_afinfo_lookup(net, family, false); 564 if (IS_ERR(afi)) 565 return PTR_ERR(afi); 566 567 table = nf_tables_table_lookup(afi, nla[NFTA_TABLE_NAME]); 568 if (IS_ERR(table)) 569 return PTR_ERR(table); 570 if (table->flags & NFT_TABLE_INACTIVE) 571 return -ENOENT; 572 573 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL); 574 if (!skb2) 575 return -ENOMEM; 576 577 err = nf_tables_fill_table_info(skb2, net, NETLINK_CB(skb).portid, 578 nlh->nlmsg_seq, NFT_MSG_NEWTABLE, 0, 579 family, table); 580 if (err < 0) 581 goto err; 582 583 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid); 584 585 err: 586 kfree_skb(skb2); 587 return err; 588 } 589 590 static int nf_tables_table_enable(const struct nft_af_info *afi, 591 struct nft_table *table) 592 { 593 struct nft_chain *chain; 594 int err, i = 0; 595 596 list_for_each_entry(chain, &table->chains, list) { 597 if (!(chain->flags & NFT_BASE_CHAIN)) 598 continue; 599 600 err = nft_register_basechain(nft_base_chain(chain), afi->nops); 601 if (err < 0) 602 goto err; 603 604 i++; 605 } 606 return 0; 607 err: 608 list_for_each_entry(chain, &table->chains, list) { 609 if (!(chain->flags & NFT_BASE_CHAIN)) 610 continue; 611 612 if (i-- <= 0) 613 break; 614 615 nft_unregister_basechain(nft_base_chain(chain), afi->nops); 616 } 617 return err; 618 } 619 620 static void nf_tables_table_disable(const struct nft_af_info *afi, 621 struct nft_table *table) 622 { 623 struct nft_chain *chain; 624 625 list_for_each_entry(chain, &table->chains, list) { 626 if (chain->flags & NFT_BASE_CHAIN) 627 nft_unregister_basechain(nft_base_chain(chain), 628 afi->nops); 629 } 630 } 631 632 static int nf_tables_updtable(struct nft_ctx *ctx) 633 { 634 struct nft_trans *trans; 635 u32 flags; 636 int ret = 0; 637 638 if (!ctx->nla[NFTA_TABLE_FLAGS]) 639 return 0; 640 641 flags = ntohl(nla_get_be32(ctx->nla[NFTA_TABLE_FLAGS])); 642 if (flags & ~NFT_TABLE_F_DORMANT) 643 return -EINVAL; 644 645 if (flags == ctx->table->flags) 646 return 0; 647 648 trans = nft_trans_alloc(ctx, NFT_MSG_NEWTABLE, 649 sizeof(struct nft_trans_table)); 650 if (trans == NULL) 651 return -ENOMEM; 652 653 if ((flags & NFT_TABLE_F_DORMANT) && 654 !(ctx->table->flags & NFT_TABLE_F_DORMANT)) { 655 nft_trans_table_enable(trans) = false; 656 } else if (!(flags & NFT_TABLE_F_DORMANT) && 657 ctx->table->flags & NFT_TABLE_F_DORMANT) { 658 ret = nf_tables_table_enable(ctx->afi, ctx->table); 659 if (ret >= 0) { 660 ctx->table->flags &= ~NFT_TABLE_F_DORMANT; 661 nft_trans_table_enable(trans) = true; 662 } 663 } 664 if (ret < 0) 665 goto err; 666 667 nft_trans_table_update(trans) = true; 668 list_add_tail(&trans->list, &ctx->net->nft.commit_list); 669 return 0; 670 err: 671 nft_trans_destroy(trans); 672 return ret; 673 } 674 675 static int nf_tables_newtable(struct sock *nlsk, struct sk_buff *skb, 676 const struct nlmsghdr *nlh, 677 const struct nlattr * const nla[]) 678 { 679 const struct nfgenmsg *nfmsg = nlmsg_data(nlh); 680 const struct nlattr *name; 681 struct nft_af_info *afi; 682 struct nft_table *table; 683 struct net *net = sock_net(skb->sk); 684 int family = nfmsg->nfgen_family; 685 u32 flags = 0; 686 struct nft_ctx ctx; 687 int err; 688 689 afi = nf_tables_afinfo_lookup(net, family, true); 690 if (IS_ERR(afi)) 691 return PTR_ERR(afi); 692 693 name = nla[NFTA_TABLE_NAME]; 694 table = nf_tables_table_lookup(afi, name); 695 if (IS_ERR(table)) { 696 if (PTR_ERR(table) != -ENOENT) 697 return PTR_ERR(table); 698 table = NULL; 699 } 700 701 if (table != NULL) { 702 if (table->flags & NFT_TABLE_INACTIVE) 703 return -ENOENT; 704 if (nlh->nlmsg_flags & NLM_F_EXCL) 705 return -EEXIST; 706 if (nlh->nlmsg_flags & NLM_F_REPLACE) 707 return -EOPNOTSUPP; 708 709 nft_ctx_init(&ctx, skb, nlh, afi, table, NULL, nla); 710 return nf_tables_updtable(&ctx); 711 } 712 713 if (nla[NFTA_TABLE_FLAGS]) { 714 flags = ntohl(nla_get_be32(nla[NFTA_TABLE_FLAGS])); 715 if (flags & ~NFT_TABLE_F_DORMANT) 716 return -EINVAL; 717 } 718 719 err = -EAFNOSUPPORT; 720 if (!try_module_get(afi->owner)) 721 goto err1; 722 723 err = -ENOMEM; 724 table = kzalloc(sizeof(*table), GFP_KERNEL); 725 if (table == NULL) 726 goto err2; 727 728 nla_strlcpy(table->name, name, NFT_TABLE_MAXNAMELEN); 729 INIT_LIST_HEAD(&table->chains); 730 INIT_LIST_HEAD(&table->sets); 731 table->flags = flags; 732 733 nft_ctx_init(&ctx, skb, nlh, afi, table, NULL, nla); 734 err = nft_trans_table_add(&ctx, NFT_MSG_NEWTABLE); 735 if (err < 0) 736 goto err3; 737 738 list_add_tail_rcu(&table->list, &afi->tables); 739 return 0; 740 err3: 741 kfree(table); 742 err2: 743 module_put(afi->owner); 744 err1: 745 return err; 746 } 747 748 static int nft_flush_table(struct nft_ctx *ctx) 749 { 750 int err; 751 struct nft_chain *chain, *nc; 752 struct nft_set *set, *ns; 753 754 list_for_each_entry(chain, &ctx->table->chains, list) { 755 ctx->chain = chain; 756 757 err = nft_delrule_by_chain(ctx); 758 if (err < 0) 759 goto out; 760 } 761 762 list_for_each_entry_safe(set, ns, &ctx->table->sets, list) { 763 if (set->flags & NFT_SET_ANONYMOUS && 764 !list_empty(&set->bindings)) 765 continue; 766 767 err = nft_delset(ctx, set); 768 if (err < 0) 769 goto out; 770 } 771 772 list_for_each_entry_safe(chain, nc, &ctx->table->chains, list) { 773 ctx->chain = chain; 774 775 err = nft_delchain(ctx); 776 if (err < 0) 777 goto out; 778 } 779 780 err = nft_deltable(ctx); 781 out: 782 return err; 783 } 784 785 static int nft_flush(struct nft_ctx *ctx, int family) 786 { 787 struct nft_af_info *afi; 788 struct nft_table *table, *nt; 789 const struct nlattr * const *nla = ctx->nla; 790 int err = 0; 791 792 list_for_each_entry(afi, &ctx->net->nft.af_info, list) { 793 if (family != AF_UNSPEC && afi->family != family) 794 continue; 795 796 ctx->afi = afi; 797 list_for_each_entry_safe(table, nt, &afi->tables, list) { 798 if (nla[NFTA_TABLE_NAME] && 799 nla_strcmp(nla[NFTA_TABLE_NAME], table->name) != 0) 800 continue; 801 802 ctx->table = table; 803 804 err = nft_flush_table(ctx); 805 if (err < 0) 806 goto out; 807 } 808 } 809 out: 810 return err; 811 } 812 813 static int nf_tables_deltable(struct sock *nlsk, struct sk_buff *skb, 814 const struct nlmsghdr *nlh, 815 const struct nlattr * const nla[]) 816 { 817 const struct nfgenmsg *nfmsg = nlmsg_data(nlh); 818 struct nft_af_info *afi; 819 struct nft_table *table; 820 struct net *net = sock_net(skb->sk); 821 int family = nfmsg->nfgen_family; 822 struct nft_ctx ctx; 823 824 nft_ctx_init(&ctx, skb, nlh, NULL, NULL, NULL, nla); 825 if (family == AF_UNSPEC || nla[NFTA_TABLE_NAME] == NULL) 826 return nft_flush(&ctx, family); 827 828 afi = nf_tables_afinfo_lookup(net, family, false); 829 if (IS_ERR(afi)) 830 return PTR_ERR(afi); 831 832 table = nf_tables_table_lookup(afi, nla[NFTA_TABLE_NAME]); 833 if (IS_ERR(table)) 834 return PTR_ERR(table); 835 if (table->flags & NFT_TABLE_INACTIVE) 836 return -ENOENT; 837 838 ctx.afi = afi; 839 ctx.table = table; 840 841 return nft_flush_table(&ctx); 842 } 843 844 static void nf_tables_table_destroy(struct nft_ctx *ctx) 845 { 846 BUG_ON(ctx->table->use > 0); 847 848 kfree(ctx->table); 849 module_put(ctx->afi->owner); 850 } 851 852 int nft_register_chain_type(const struct nf_chain_type *ctype) 853 { 854 int err = 0; 855 856 nfnl_lock(NFNL_SUBSYS_NFTABLES); 857 if (chain_type[ctype->family][ctype->type] != NULL) { 858 err = -EBUSY; 859 goto out; 860 } 861 chain_type[ctype->family][ctype->type] = ctype; 862 out: 863 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 864 return err; 865 } 866 EXPORT_SYMBOL_GPL(nft_register_chain_type); 867 868 void nft_unregister_chain_type(const struct nf_chain_type *ctype) 869 { 870 nfnl_lock(NFNL_SUBSYS_NFTABLES); 871 chain_type[ctype->family][ctype->type] = NULL; 872 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 873 } 874 EXPORT_SYMBOL_GPL(nft_unregister_chain_type); 875 876 /* 877 * Chains 878 */ 879 880 static struct nft_chain * 881 nf_tables_chain_lookup_byhandle(const struct nft_table *table, u64 handle) 882 { 883 struct nft_chain *chain; 884 885 list_for_each_entry(chain, &table->chains, list) { 886 if (chain->handle == handle) 887 return chain; 888 } 889 890 return ERR_PTR(-ENOENT); 891 } 892 893 static struct nft_chain *nf_tables_chain_lookup(const struct nft_table *table, 894 const struct nlattr *nla) 895 { 896 struct nft_chain *chain; 897 898 if (nla == NULL) 899 return ERR_PTR(-EINVAL); 900 901 list_for_each_entry(chain, &table->chains, list) { 902 if (!nla_strcmp(nla, chain->name)) 903 return chain; 904 } 905 906 return ERR_PTR(-ENOENT); 907 } 908 909 static const struct nla_policy nft_chain_policy[NFTA_CHAIN_MAX + 1] = { 910 [NFTA_CHAIN_TABLE] = { .type = NLA_STRING }, 911 [NFTA_CHAIN_HANDLE] = { .type = NLA_U64 }, 912 [NFTA_CHAIN_NAME] = { .type = NLA_STRING, 913 .len = NFT_CHAIN_MAXNAMELEN - 1 }, 914 [NFTA_CHAIN_HOOK] = { .type = NLA_NESTED }, 915 [NFTA_CHAIN_POLICY] = { .type = NLA_U32 }, 916 [NFTA_CHAIN_TYPE] = { .type = NLA_STRING }, 917 [NFTA_CHAIN_COUNTERS] = { .type = NLA_NESTED }, 918 }; 919 920 static const struct nla_policy nft_hook_policy[NFTA_HOOK_MAX + 1] = { 921 [NFTA_HOOK_HOOKNUM] = { .type = NLA_U32 }, 922 [NFTA_HOOK_PRIORITY] = { .type = NLA_U32 }, 923 [NFTA_HOOK_DEV] = { .type = NLA_STRING, 924 .len = IFNAMSIZ - 1 }, 925 }; 926 927 static int nft_dump_stats(struct sk_buff *skb, struct nft_stats __percpu *stats) 928 { 929 struct nft_stats *cpu_stats, total; 930 struct nlattr *nest; 931 unsigned int seq; 932 u64 pkts, bytes; 933 int cpu; 934 935 memset(&total, 0, sizeof(total)); 936 for_each_possible_cpu(cpu) { 937 cpu_stats = per_cpu_ptr(stats, cpu); 938 do { 939 seq = u64_stats_fetch_begin_irq(&cpu_stats->syncp); 940 pkts = cpu_stats->pkts; 941 bytes = cpu_stats->bytes; 942 } while (u64_stats_fetch_retry_irq(&cpu_stats->syncp, seq)); 943 total.pkts += pkts; 944 total.bytes += bytes; 945 } 946 nest = nla_nest_start(skb, NFTA_CHAIN_COUNTERS); 947 if (nest == NULL) 948 goto nla_put_failure; 949 950 if (nla_put_be64(skb, NFTA_COUNTER_PACKETS, cpu_to_be64(total.pkts)) || 951 nla_put_be64(skb, NFTA_COUNTER_BYTES, cpu_to_be64(total.bytes))) 952 goto nla_put_failure; 953 954 nla_nest_end(skb, nest); 955 return 0; 956 957 nla_put_failure: 958 return -ENOSPC; 959 } 960 961 static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net, 962 u32 portid, u32 seq, int event, u32 flags, 963 int family, const struct nft_table *table, 964 const struct nft_chain *chain) 965 { 966 struct nlmsghdr *nlh; 967 struct nfgenmsg *nfmsg; 968 969 event |= NFNL_SUBSYS_NFTABLES << 8; 970 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags); 971 if (nlh == NULL) 972 goto nla_put_failure; 973 974 nfmsg = nlmsg_data(nlh); 975 nfmsg->nfgen_family = family; 976 nfmsg->version = NFNETLINK_V0; 977 nfmsg->res_id = htons(net->nft.base_seq & 0xffff); 978 979 if (nla_put_string(skb, NFTA_CHAIN_TABLE, table->name)) 980 goto nla_put_failure; 981 if (nla_put_be64(skb, NFTA_CHAIN_HANDLE, cpu_to_be64(chain->handle))) 982 goto nla_put_failure; 983 if (nla_put_string(skb, NFTA_CHAIN_NAME, chain->name)) 984 goto nla_put_failure; 985 986 if (chain->flags & NFT_BASE_CHAIN) { 987 const struct nft_base_chain *basechain = nft_base_chain(chain); 988 const struct nf_hook_ops *ops = &basechain->ops[0]; 989 struct nlattr *nest; 990 991 nest = nla_nest_start(skb, NFTA_CHAIN_HOOK); 992 if (nest == NULL) 993 goto nla_put_failure; 994 if (nla_put_be32(skb, NFTA_HOOK_HOOKNUM, htonl(ops->hooknum))) 995 goto nla_put_failure; 996 if (nla_put_be32(skb, NFTA_HOOK_PRIORITY, htonl(ops->priority))) 997 goto nla_put_failure; 998 if (basechain->dev_name[0] && 999 nla_put_string(skb, NFTA_HOOK_DEV, basechain->dev_name)) 1000 goto nla_put_failure; 1001 nla_nest_end(skb, nest); 1002 1003 if (nla_put_be32(skb, NFTA_CHAIN_POLICY, 1004 htonl(basechain->policy))) 1005 goto nla_put_failure; 1006 1007 if (nla_put_string(skb, NFTA_CHAIN_TYPE, basechain->type->name)) 1008 goto nla_put_failure; 1009 1010 if (nft_dump_stats(skb, nft_base_chain(chain)->stats)) 1011 goto nla_put_failure; 1012 } 1013 1014 if (nla_put_be32(skb, NFTA_CHAIN_USE, htonl(chain->use))) 1015 goto nla_put_failure; 1016 1017 nlmsg_end(skb, nlh); 1018 return 0; 1019 1020 nla_put_failure: 1021 nlmsg_trim(skb, nlh); 1022 return -1; 1023 } 1024 1025 static int nf_tables_chain_notify(const struct nft_ctx *ctx, int event) 1026 { 1027 struct sk_buff *skb; 1028 int err; 1029 1030 if (!ctx->report && 1031 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) 1032 return 0; 1033 1034 err = -ENOBUFS; 1035 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 1036 if (skb == NULL) 1037 goto err; 1038 1039 err = nf_tables_fill_chain_info(skb, ctx->net, ctx->portid, ctx->seq, 1040 event, 0, ctx->afi->family, ctx->table, 1041 ctx->chain); 1042 if (err < 0) { 1043 kfree_skb(skb); 1044 goto err; 1045 } 1046 1047 err = nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES, 1048 ctx->report, GFP_KERNEL); 1049 err: 1050 if (err < 0) { 1051 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, 1052 err); 1053 } 1054 return err; 1055 } 1056 1057 static int nf_tables_dump_chains(struct sk_buff *skb, 1058 struct netlink_callback *cb) 1059 { 1060 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); 1061 const struct nft_af_info *afi; 1062 const struct nft_table *table; 1063 const struct nft_chain *chain; 1064 unsigned int idx = 0, s_idx = cb->args[0]; 1065 struct net *net = sock_net(skb->sk); 1066 int family = nfmsg->nfgen_family; 1067 1068 rcu_read_lock(); 1069 cb->seq = net->nft.base_seq; 1070 1071 list_for_each_entry_rcu(afi, &net->nft.af_info, list) { 1072 if (family != NFPROTO_UNSPEC && family != afi->family) 1073 continue; 1074 1075 list_for_each_entry_rcu(table, &afi->tables, list) { 1076 list_for_each_entry_rcu(chain, &table->chains, list) { 1077 if (idx < s_idx) 1078 goto cont; 1079 if (idx > s_idx) 1080 memset(&cb->args[1], 0, 1081 sizeof(cb->args) - sizeof(cb->args[0])); 1082 if (nf_tables_fill_chain_info(skb, net, 1083 NETLINK_CB(cb->skb).portid, 1084 cb->nlh->nlmsg_seq, 1085 NFT_MSG_NEWCHAIN, 1086 NLM_F_MULTI, 1087 afi->family, table, chain) < 0) 1088 goto done; 1089 1090 nl_dump_check_consistent(cb, nlmsg_hdr(skb)); 1091 cont: 1092 idx++; 1093 } 1094 } 1095 } 1096 done: 1097 rcu_read_unlock(); 1098 cb->args[0] = idx; 1099 return skb->len; 1100 } 1101 1102 static int nf_tables_getchain(struct sock *nlsk, struct sk_buff *skb, 1103 const struct nlmsghdr *nlh, 1104 const struct nlattr * const nla[]) 1105 { 1106 const struct nfgenmsg *nfmsg = nlmsg_data(nlh); 1107 const struct nft_af_info *afi; 1108 const struct nft_table *table; 1109 const struct nft_chain *chain; 1110 struct sk_buff *skb2; 1111 struct net *net = sock_net(skb->sk); 1112 int family = nfmsg->nfgen_family; 1113 int err; 1114 1115 if (nlh->nlmsg_flags & NLM_F_DUMP) { 1116 struct netlink_dump_control c = { 1117 .dump = nf_tables_dump_chains, 1118 }; 1119 return netlink_dump_start(nlsk, skb, nlh, &c); 1120 } 1121 1122 afi = nf_tables_afinfo_lookup(net, family, false); 1123 if (IS_ERR(afi)) 1124 return PTR_ERR(afi); 1125 1126 table = nf_tables_table_lookup(afi, nla[NFTA_CHAIN_TABLE]); 1127 if (IS_ERR(table)) 1128 return PTR_ERR(table); 1129 if (table->flags & NFT_TABLE_INACTIVE) 1130 return -ENOENT; 1131 1132 chain = nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME]); 1133 if (IS_ERR(chain)) 1134 return PTR_ERR(chain); 1135 if (chain->flags & NFT_CHAIN_INACTIVE) 1136 return -ENOENT; 1137 1138 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL); 1139 if (!skb2) 1140 return -ENOMEM; 1141 1142 err = nf_tables_fill_chain_info(skb2, net, NETLINK_CB(skb).portid, 1143 nlh->nlmsg_seq, NFT_MSG_NEWCHAIN, 0, 1144 family, table, chain); 1145 if (err < 0) 1146 goto err; 1147 1148 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid); 1149 1150 err: 1151 kfree_skb(skb2); 1152 return err; 1153 } 1154 1155 static const struct nla_policy nft_counter_policy[NFTA_COUNTER_MAX + 1] = { 1156 [NFTA_COUNTER_PACKETS] = { .type = NLA_U64 }, 1157 [NFTA_COUNTER_BYTES] = { .type = NLA_U64 }, 1158 }; 1159 1160 static struct nft_stats __percpu *nft_stats_alloc(const struct nlattr *attr) 1161 { 1162 struct nlattr *tb[NFTA_COUNTER_MAX+1]; 1163 struct nft_stats __percpu *newstats; 1164 struct nft_stats *stats; 1165 int err; 1166 1167 err = nla_parse_nested(tb, NFTA_COUNTER_MAX, attr, nft_counter_policy); 1168 if (err < 0) 1169 return ERR_PTR(err); 1170 1171 if (!tb[NFTA_COUNTER_BYTES] || !tb[NFTA_COUNTER_PACKETS]) 1172 return ERR_PTR(-EINVAL); 1173 1174 newstats = netdev_alloc_pcpu_stats(struct nft_stats); 1175 if (newstats == NULL) 1176 return ERR_PTR(-ENOMEM); 1177 1178 /* Restore old counters on this cpu, no problem. Per-cpu statistics 1179 * are not exposed to userspace. 1180 */ 1181 preempt_disable(); 1182 stats = this_cpu_ptr(newstats); 1183 stats->bytes = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_BYTES])); 1184 stats->pkts = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_PACKETS])); 1185 preempt_enable(); 1186 1187 return newstats; 1188 } 1189 1190 static void nft_chain_stats_replace(struct nft_base_chain *chain, 1191 struct nft_stats __percpu *newstats) 1192 { 1193 if (newstats == NULL) 1194 return; 1195 1196 if (chain->stats) { 1197 struct nft_stats __percpu *oldstats = 1198 nft_dereference(chain->stats); 1199 1200 rcu_assign_pointer(chain->stats, newstats); 1201 synchronize_rcu(); 1202 free_percpu(oldstats); 1203 } else 1204 rcu_assign_pointer(chain->stats, newstats); 1205 } 1206 1207 static void nf_tables_chain_destroy(struct nft_chain *chain) 1208 { 1209 BUG_ON(chain->use > 0); 1210 1211 if (chain->flags & NFT_BASE_CHAIN) { 1212 struct nft_base_chain *basechain = nft_base_chain(chain); 1213 1214 module_put(basechain->type->owner); 1215 free_percpu(basechain->stats); 1216 if (basechain->ops[0].dev != NULL) 1217 dev_put(basechain->ops[0].dev); 1218 kfree(basechain); 1219 } else { 1220 kfree(chain); 1221 } 1222 } 1223 1224 static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb, 1225 const struct nlmsghdr *nlh, 1226 const struct nlattr * const nla[]) 1227 { 1228 const struct nfgenmsg *nfmsg = nlmsg_data(nlh); 1229 const struct nlattr * uninitialized_var(name); 1230 struct nft_af_info *afi; 1231 struct nft_table *table; 1232 struct nft_chain *chain; 1233 struct nft_base_chain *basechain = NULL; 1234 struct nlattr *ha[NFTA_HOOK_MAX + 1]; 1235 struct net *net = sock_net(skb->sk); 1236 int family = nfmsg->nfgen_family; 1237 struct net_device *dev = NULL; 1238 u8 policy = NF_ACCEPT; 1239 u64 handle = 0; 1240 unsigned int i; 1241 struct nft_stats __percpu *stats; 1242 int err; 1243 bool create; 1244 struct nft_ctx ctx; 1245 1246 create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false; 1247 1248 afi = nf_tables_afinfo_lookup(net, family, true); 1249 if (IS_ERR(afi)) 1250 return PTR_ERR(afi); 1251 1252 table = nf_tables_table_lookup(afi, nla[NFTA_CHAIN_TABLE]); 1253 if (IS_ERR(table)) 1254 return PTR_ERR(table); 1255 1256 chain = NULL; 1257 name = nla[NFTA_CHAIN_NAME]; 1258 1259 if (nla[NFTA_CHAIN_HANDLE]) { 1260 handle = be64_to_cpu(nla_get_be64(nla[NFTA_CHAIN_HANDLE])); 1261 chain = nf_tables_chain_lookup_byhandle(table, handle); 1262 if (IS_ERR(chain)) 1263 return PTR_ERR(chain); 1264 } else { 1265 chain = nf_tables_chain_lookup(table, name); 1266 if (IS_ERR(chain)) { 1267 if (PTR_ERR(chain) != -ENOENT) 1268 return PTR_ERR(chain); 1269 chain = NULL; 1270 } 1271 } 1272 1273 if (nla[NFTA_CHAIN_POLICY]) { 1274 if ((chain != NULL && 1275 !(chain->flags & NFT_BASE_CHAIN))) 1276 return -EOPNOTSUPP; 1277 1278 if (chain == NULL && 1279 nla[NFTA_CHAIN_HOOK] == NULL) 1280 return -EOPNOTSUPP; 1281 1282 policy = ntohl(nla_get_be32(nla[NFTA_CHAIN_POLICY])); 1283 switch (policy) { 1284 case NF_DROP: 1285 case NF_ACCEPT: 1286 break; 1287 default: 1288 return -EINVAL; 1289 } 1290 } 1291 1292 if (chain != NULL) { 1293 struct nft_stats *stats = NULL; 1294 struct nft_trans *trans; 1295 1296 if (chain->flags & NFT_CHAIN_INACTIVE) 1297 return -ENOENT; 1298 if (nlh->nlmsg_flags & NLM_F_EXCL) 1299 return -EEXIST; 1300 if (nlh->nlmsg_flags & NLM_F_REPLACE) 1301 return -EOPNOTSUPP; 1302 1303 if (nla[NFTA_CHAIN_HANDLE] && name && 1304 !IS_ERR(nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME]))) 1305 return -EEXIST; 1306 1307 if (nla[NFTA_CHAIN_COUNTERS]) { 1308 if (!(chain->flags & NFT_BASE_CHAIN)) 1309 return -EOPNOTSUPP; 1310 1311 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]); 1312 if (IS_ERR(stats)) 1313 return PTR_ERR(stats); 1314 } 1315 1316 nft_ctx_init(&ctx, skb, nlh, afi, table, chain, nla); 1317 trans = nft_trans_alloc(&ctx, NFT_MSG_NEWCHAIN, 1318 sizeof(struct nft_trans_chain)); 1319 if (trans == NULL) { 1320 free_percpu(stats); 1321 return -ENOMEM; 1322 } 1323 1324 nft_trans_chain_stats(trans) = stats; 1325 nft_trans_chain_update(trans) = true; 1326 1327 if (nla[NFTA_CHAIN_POLICY]) 1328 nft_trans_chain_policy(trans) = policy; 1329 else 1330 nft_trans_chain_policy(trans) = -1; 1331 1332 if (nla[NFTA_CHAIN_HANDLE] && name) { 1333 nla_strlcpy(nft_trans_chain_name(trans), name, 1334 NFT_CHAIN_MAXNAMELEN); 1335 } 1336 list_add_tail(&trans->list, &net->nft.commit_list); 1337 return 0; 1338 } 1339 1340 if (table->use == UINT_MAX) 1341 return -EOVERFLOW; 1342 1343 if (nla[NFTA_CHAIN_HOOK]) { 1344 const struct nf_chain_type *type; 1345 struct nf_hook_ops *ops; 1346 nf_hookfn *hookfn; 1347 u32 hooknum, priority; 1348 1349 type = chain_type[family][NFT_CHAIN_T_DEFAULT]; 1350 if (nla[NFTA_CHAIN_TYPE]) { 1351 type = nf_tables_chain_type_lookup(afi, 1352 nla[NFTA_CHAIN_TYPE], 1353 create); 1354 if (IS_ERR(type)) 1355 return PTR_ERR(type); 1356 } 1357 1358 err = nla_parse_nested(ha, NFTA_HOOK_MAX, nla[NFTA_CHAIN_HOOK], 1359 nft_hook_policy); 1360 if (err < 0) 1361 return err; 1362 if (ha[NFTA_HOOK_HOOKNUM] == NULL || 1363 ha[NFTA_HOOK_PRIORITY] == NULL) 1364 return -EINVAL; 1365 1366 hooknum = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM])); 1367 if (hooknum >= afi->nhooks) 1368 return -EINVAL; 1369 priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY])); 1370 1371 if (!(type->hook_mask & (1 << hooknum))) 1372 return -EOPNOTSUPP; 1373 if (!try_module_get(type->owner)) 1374 return -ENOENT; 1375 hookfn = type->hooks[hooknum]; 1376 1377 if (afi->flags & NFT_AF_NEEDS_DEV) { 1378 char ifname[IFNAMSIZ]; 1379 1380 if (!ha[NFTA_HOOK_DEV]) { 1381 module_put(type->owner); 1382 return -EOPNOTSUPP; 1383 } 1384 1385 nla_strlcpy(ifname, ha[NFTA_HOOK_DEV], IFNAMSIZ); 1386 dev = dev_get_by_name(net, ifname); 1387 if (!dev) { 1388 module_put(type->owner); 1389 return -ENOENT; 1390 } 1391 } else if (ha[NFTA_HOOK_DEV]) { 1392 module_put(type->owner); 1393 return -EOPNOTSUPP; 1394 } 1395 1396 basechain = kzalloc(sizeof(*basechain), GFP_KERNEL); 1397 if (basechain == NULL) { 1398 module_put(type->owner); 1399 if (dev != NULL) 1400 dev_put(dev); 1401 return -ENOMEM; 1402 } 1403 1404 if (dev != NULL) 1405 strncpy(basechain->dev_name, dev->name, IFNAMSIZ); 1406 1407 if (nla[NFTA_CHAIN_COUNTERS]) { 1408 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]); 1409 if (IS_ERR(stats)) { 1410 module_put(type->owner); 1411 kfree(basechain); 1412 if (dev != NULL) 1413 dev_put(dev); 1414 return PTR_ERR(stats); 1415 } 1416 basechain->stats = stats; 1417 } else { 1418 stats = netdev_alloc_pcpu_stats(struct nft_stats); 1419 if (stats == NULL) { 1420 module_put(type->owner); 1421 kfree(basechain); 1422 if (dev != NULL) 1423 dev_put(dev); 1424 return -ENOMEM; 1425 } 1426 rcu_assign_pointer(basechain->stats, stats); 1427 } 1428 1429 write_pnet(&basechain->pnet, net); 1430 basechain->type = type; 1431 chain = &basechain->chain; 1432 1433 for (i = 0; i < afi->nops; i++) { 1434 ops = &basechain->ops[i]; 1435 ops->pf = family; 1436 ops->hooknum = hooknum; 1437 ops->priority = priority; 1438 ops->priv = chain; 1439 ops->hook = afi->hooks[ops->hooknum]; 1440 ops->dev = dev; 1441 if (hookfn) 1442 ops->hook = hookfn; 1443 if (afi->hook_ops_init) 1444 afi->hook_ops_init(ops, i); 1445 } 1446 1447 chain->flags |= NFT_BASE_CHAIN; 1448 basechain->policy = policy; 1449 } else { 1450 chain = kzalloc(sizeof(*chain), GFP_KERNEL); 1451 if (chain == NULL) 1452 return -ENOMEM; 1453 } 1454 1455 INIT_LIST_HEAD(&chain->rules); 1456 chain->handle = nf_tables_alloc_handle(table); 1457 chain->table = table; 1458 nla_strlcpy(chain->name, name, NFT_CHAIN_MAXNAMELEN); 1459 1460 err = nf_tables_register_hooks(table, chain, afi->nops); 1461 if (err < 0) 1462 goto err1; 1463 1464 nft_ctx_init(&ctx, skb, nlh, afi, table, chain, nla); 1465 err = nft_trans_chain_add(&ctx, NFT_MSG_NEWCHAIN); 1466 if (err < 0) 1467 goto err2; 1468 1469 table->use++; 1470 list_add_tail_rcu(&chain->list, &table->chains); 1471 return 0; 1472 err2: 1473 nf_tables_unregister_hooks(table, chain, afi->nops); 1474 err1: 1475 nf_tables_chain_destroy(chain); 1476 return err; 1477 } 1478 1479 static int nf_tables_delchain(struct sock *nlsk, struct sk_buff *skb, 1480 const struct nlmsghdr *nlh, 1481 const struct nlattr * const nla[]) 1482 { 1483 const struct nfgenmsg *nfmsg = nlmsg_data(nlh); 1484 struct nft_af_info *afi; 1485 struct nft_table *table; 1486 struct nft_chain *chain; 1487 struct net *net = sock_net(skb->sk); 1488 int family = nfmsg->nfgen_family; 1489 struct nft_ctx ctx; 1490 1491 afi = nf_tables_afinfo_lookup(net, family, false); 1492 if (IS_ERR(afi)) 1493 return PTR_ERR(afi); 1494 1495 table = nf_tables_table_lookup(afi, nla[NFTA_CHAIN_TABLE]); 1496 if (IS_ERR(table)) 1497 return PTR_ERR(table); 1498 if (table->flags & NFT_TABLE_INACTIVE) 1499 return -ENOENT; 1500 1501 chain = nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME]); 1502 if (IS_ERR(chain)) 1503 return PTR_ERR(chain); 1504 if (chain->flags & NFT_CHAIN_INACTIVE) 1505 return -ENOENT; 1506 if (chain->use > 0) 1507 return -EBUSY; 1508 1509 nft_ctx_init(&ctx, skb, nlh, afi, table, chain, nla); 1510 1511 return nft_delchain(&ctx); 1512 } 1513 1514 /* 1515 * Expressions 1516 */ 1517 1518 /** 1519 * nft_register_expr - register nf_tables expr type 1520 * @ops: expr type 1521 * 1522 * Registers the expr type for use with nf_tables. Returns zero on 1523 * success or a negative errno code otherwise. 1524 */ 1525 int nft_register_expr(struct nft_expr_type *type) 1526 { 1527 nfnl_lock(NFNL_SUBSYS_NFTABLES); 1528 if (type->family == NFPROTO_UNSPEC) 1529 list_add_tail_rcu(&type->list, &nf_tables_expressions); 1530 else 1531 list_add_rcu(&type->list, &nf_tables_expressions); 1532 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 1533 return 0; 1534 } 1535 EXPORT_SYMBOL_GPL(nft_register_expr); 1536 1537 /** 1538 * nft_unregister_expr - unregister nf_tables expr type 1539 * @ops: expr type 1540 * 1541 * Unregisters the expr typefor use with nf_tables. 1542 */ 1543 void nft_unregister_expr(struct nft_expr_type *type) 1544 { 1545 nfnl_lock(NFNL_SUBSYS_NFTABLES); 1546 list_del_rcu(&type->list); 1547 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 1548 } 1549 EXPORT_SYMBOL_GPL(nft_unregister_expr); 1550 1551 static const struct nft_expr_type *__nft_expr_type_get(u8 family, 1552 struct nlattr *nla) 1553 { 1554 const struct nft_expr_type *type; 1555 1556 list_for_each_entry(type, &nf_tables_expressions, list) { 1557 if (!nla_strcmp(nla, type->name) && 1558 (!type->family || type->family == family)) 1559 return type; 1560 } 1561 return NULL; 1562 } 1563 1564 static const struct nft_expr_type *nft_expr_type_get(u8 family, 1565 struct nlattr *nla) 1566 { 1567 const struct nft_expr_type *type; 1568 1569 if (nla == NULL) 1570 return ERR_PTR(-EINVAL); 1571 1572 type = __nft_expr_type_get(family, nla); 1573 if (type != NULL && try_module_get(type->owner)) 1574 return type; 1575 1576 #ifdef CONFIG_MODULES 1577 if (type == NULL) { 1578 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 1579 request_module("nft-expr-%u-%.*s", family, 1580 nla_len(nla), (char *)nla_data(nla)); 1581 nfnl_lock(NFNL_SUBSYS_NFTABLES); 1582 if (__nft_expr_type_get(family, nla)) 1583 return ERR_PTR(-EAGAIN); 1584 1585 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 1586 request_module("nft-expr-%.*s", 1587 nla_len(nla), (char *)nla_data(nla)); 1588 nfnl_lock(NFNL_SUBSYS_NFTABLES); 1589 if (__nft_expr_type_get(family, nla)) 1590 return ERR_PTR(-EAGAIN); 1591 } 1592 #endif 1593 return ERR_PTR(-ENOENT); 1594 } 1595 1596 static const struct nla_policy nft_expr_policy[NFTA_EXPR_MAX + 1] = { 1597 [NFTA_EXPR_NAME] = { .type = NLA_STRING }, 1598 [NFTA_EXPR_DATA] = { .type = NLA_NESTED }, 1599 }; 1600 1601 static int nf_tables_fill_expr_info(struct sk_buff *skb, 1602 const struct nft_expr *expr) 1603 { 1604 if (nla_put_string(skb, NFTA_EXPR_NAME, expr->ops->type->name)) 1605 goto nla_put_failure; 1606 1607 if (expr->ops->dump) { 1608 struct nlattr *data = nla_nest_start(skb, NFTA_EXPR_DATA); 1609 if (data == NULL) 1610 goto nla_put_failure; 1611 if (expr->ops->dump(skb, expr) < 0) 1612 goto nla_put_failure; 1613 nla_nest_end(skb, data); 1614 } 1615 1616 return skb->len; 1617 1618 nla_put_failure: 1619 return -1; 1620 }; 1621 1622 int nft_expr_dump(struct sk_buff *skb, unsigned int attr, 1623 const struct nft_expr *expr) 1624 { 1625 struct nlattr *nest; 1626 1627 nest = nla_nest_start(skb, attr); 1628 if (!nest) 1629 goto nla_put_failure; 1630 if (nf_tables_fill_expr_info(skb, expr) < 0) 1631 goto nla_put_failure; 1632 nla_nest_end(skb, nest); 1633 return 0; 1634 1635 nla_put_failure: 1636 return -1; 1637 } 1638 1639 struct nft_expr_info { 1640 const struct nft_expr_ops *ops; 1641 struct nlattr *tb[NFT_EXPR_MAXATTR + 1]; 1642 }; 1643 1644 static int nf_tables_expr_parse(const struct nft_ctx *ctx, 1645 const struct nlattr *nla, 1646 struct nft_expr_info *info) 1647 { 1648 const struct nft_expr_type *type; 1649 const struct nft_expr_ops *ops; 1650 struct nlattr *tb[NFTA_EXPR_MAX + 1]; 1651 int err; 1652 1653 err = nla_parse_nested(tb, NFTA_EXPR_MAX, nla, nft_expr_policy); 1654 if (err < 0) 1655 return err; 1656 1657 type = nft_expr_type_get(ctx->afi->family, tb[NFTA_EXPR_NAME]); 1658 if (IS_ERR(type)) 1659 return PTR_ERR(type); 1660 1661 if (tb[NFTA_EXPR_DATA]) { 1662 err = nla_parse_nested(info->tb, type->maxattr, 1663 tb[NFTA_EXPR_DATA], type->policy); 1664 if (err < 0) 1665 goto err1; 1666 } else 1667 memset(info->tb, 0, sizeof(info->tb[0]) * (type->maxattr + 1)); 1668 1669 if (type->select_ops != NULL) { 1670 ops = type->select_ops(ctx, 1671 (const struct nlattr * const *)info->tb); 1672 if (IS_ERR(ops)) { 1673 err = PTR_ERR(ops); 1674 goto err1; 1675 } 1676 } else 1677 ops = type->ops; 1678 1679 info->ops = ops; 1680 return 0; 1681 1682 err1: 1683 module_put(type->owner); 1684 return err; 1685 } 1686 1687 static int nf_tables_newexpr(const struct nft_ctx *ctx, 1688 const struct nft_expr_info *info, 1689 struct nft_expr *expr) 1690 { 1691 const struct nft_expr_ops *ops = info->ops; 1692 int err; 1693 1694 expr->ops = ops; 1695 if (ops->init) { 1696 err = ops->init(ctx, expr, (const struct nlattr **)info->tb); 1697 if (err < 0) 1698 goto err1; 1699 } 1700 1701 return 0; 1702 1703 err1: 1704 expr->ops = NULL; 1705 return err; 1706 } 1707 1708 static void nf_tables_expr_destroy(const struct nft_ctx *ctx, 1709 struct nft_expr *expr) 1710 { 1711 if (expr->ops->destroy) 1712 expr->ops->destroy(ctx, expr); 1713 module_put(expr->ops->type->owner); 1714 } 1715 1716 struct nft_expr *nft_expr_init(const struct nft_ctx *ctx, 1717 const struct nlattr *nla) 1718 { 1719 struct nft_expr_info info; 1720 struct nft_expr *expr; 1721 int err; 1722 1723 err = nf_tables_expr_parse(ctx, nla, &info); 1724 if (err < 0) 1725 goto err1; 1726 1727 err = -ENOMEM; 1728 expr = kzalloc(info.ops->size, GFP_KERNEL); 1729 if (expr == NULL) 1730 goto err2; 1731 1732 err = nf_tables_newexpr(ctx, &info, expr); 1733 if (err < 0) 1734 goto err2; 1735 1736 return expr; 1737 err2: 1738 module_put(info.ops->type->owner); 1739 err1: 1740 return ERR_PTR(err); 1741 } 1742 1743 void nft_expr_destroy(const struct nft_ctx *ctx, struct nft_expr *expr) 1744 { 1745 nf_tables_expr_destroy(ctx, expr); 1746 kfree(expr); 1747 } 1748 1749 /* 1750 * Rules 1751 */ 1752 1753 static struct nft_rule *__nf_tables_rule_lookup(const struct nft_chain *chain, 1754 u64 handle) 1755 { 1756 struct nft_rule *rule; 1757 1758 // FIXME: this sucks 1759 list_for_each_entry(rule, &chain->rules, list) { 1760 if (handle == rule->handle) 1761 return rule; 1762 } 1763 1764 return ERR_PTR(-ENOENT); 1765 } 1766 1767 static struct nft_rule *nf_tables_rule_lookup(const struct nft_chain *chain, 1768 const struct nlattr *nla) 1769 { 1770 if (nla == NULL) 1771 return ERR_PTR(-EINVAL); 1772 1773 return __nf_tables_rule_lookup(chain, be64_to_cpu(nla_get_be64(nla))); 1774 } 1775 1776 static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX + 1] = { 1777 [NFTA_RULE_TABLE] = { .type = NLA_STRING }, 1778 [NFTA_RULE_CHAIN] = { .type = NLA_STRING, 1779 .len = NFT_CHAIN_MAXNAMELEN - 1 }, 1780 [NFTA_RULE_HANDLE] = { .type = NLA_U64 }, 1781 [NFTA_RULE_EXPRESSIONS] = { .type = NLA_NESTED }, 1782 [NFTA_RULE_COMPAT] = { .type = NLA_NESTED }, 1783 [NFTA_RULE_POSITION] = { .type = NLA_U64 }, 1784 [NFTA_RULE_USERDATA] = { .type = NLA_BINARY, 1785 .len = NFT_USERDATA_MAXLEN }, 1786 }; 1787 1788 static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net, 1789 u32 portid, u32 seq, int event, 1790 u32 flags, int family, 1791 const struct nft_table *table, 1792 const struct nft_chain *chain, 1793 const struct nft_rule *rule) 1794 { 1795 struct nlmsghdr *nlh; 1796 struct nfgenmsg *nfmsg; 1797 const struct nft_expr *expr, *next; 1798 struct nlattr *list; 1799 const struct nft_rule *prule; 1800 int type = event | NFNL_SUBSYS_NFTABLES << 8; 1801 1802 nlh = nlmsg_put(skb, portid, seq, type, sizeof(struct nfgenmsg), 1803 flags); 1804 if (nlh == NULL) 1805 goto nla_put_failure; 1806 1807 nfmsg = nlmsg_data(nlh); 1808 nfmsg->nfgen_family = family; 1809 nfmsg->version = NFNETLINK_V0; 1810 nfmsg->res_id = htons(net->nft.base_seq & 0xffff); 1811 1812 if (nla_put_string(skb, NFTA_RULE_TABLE, table->name)) 1813 goto nla_put_failure; 1814 if (nla_put_string(skb, NFTA_RULE_CHAIN, chain->name)) 1815 goto nla_put_failure; 1816 if (nla_put_be64(skb, NFTA_RULE_HANDLE, cpu_to_be64(rule->handle))) 1817 goto nla_put_failure; 1818 1819 if ((event != NFT_MSG_DELRULE) && (rule->list.prev != &chain->rules)) { 1820 prule = list_entry(rule->list.prev, struct nft_rule, list); 1821 if (nla_put_be64(skb, NFTA_RULE_POSITION, 1822 cpu_to_be64(prule->handle))) 1823 goto nla_put_failure; 1824 } 1825 1826 list = nla_nest_start(skb, NFTA_RULE_EXPRESSIONS); 1827 if (list == NULL) 1828 goto nla_put_failure; 1829 nft_rule_for_each_expr(expr, next, rule) { 1830 if (nft_expr_dump(skb, NFTA_LIST_ELEM, expr) < 0) 1831 goto nla_put_failure; 1832 } 1833 nla_nest_end(skb, list); 1834 1835 if (rule->udata) { 1836 struct nft_userdata *udata = nft_userdata(rule); 1837 if (nla_put(skb, NFTA_RULE_USERDATA, udata->len + 1, 1838 udata->data) < 0) 1839 goto nla_put_failure; 1840 } 1841 1842 nlmsg_end(skb, nlh); 1843 return 0; 1844 1845 nla_put_failure: 1846 nlmsg_trim(skb, nlh); 1847 return -1; 1848 } 1849 1850 static int nf_tables_rule_notify(const struct nft_ctx *ctx, 1851 const struct nft_rule *rule, 1852 int event) 1853 { 1854 struct sk_buff *skb; 1855 int err; 1856 1857 if (!ctx->report && 1858 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) 1859 return 0; 1860 1861 err = -ENOBUFS; 1862 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 1863 if (skb == NULL) 1864 goto err; 1865 1866 err = nf_tables_fill_rule_info(skb, ctx->net, ctx->portid, ctx->seq, 1867 event, 0, ctx->afi->family, ctx->table, 1868 ctx->chain, rule); 1869 if (err < 0) { 1870 kfree_skb(skb); 1871 goto err; 1872 } 1873 1874 err = nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES, 1875 ctx->report, GFP_KERNEL); 1876 err: 1877 if (err < 0) { 1878 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, 1879 err); 1880 } 1881 return err; 1882 } 1883 1884 static int nf_tables_dump_rules(struct sk_buff *skb, 1885 struct netlink_callback *cb) 1886 { 1887 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); 1888 const struct nft_af_info *afi; 1889 const struct nft_table *table; 1890 const struct nft_chain *chain; 1891 const struct nft_rule *rule; 1892 unsigned int idx = 0, s_idx = cb->args[0]; 1893 struct net *net = sock_net(skb->sk); 1894 int family = nfmsg->nfgen_family; 1895 1896 rcu_read_lock(); 1897 cb->seq = net->nft.base_seq; 1898 1899 list_for_each_entry_rcu(afi, &net->nft.af_info, list) { 1900 if (family != NFPROTO_UNSPEC && family != afi->family) 1901 continue; 1902 1903 list_for_each_entry_rcu(table, &afi->tables, list) { 1904 list_for_each_entry_rcu(chain, &table->chains, list) { 1905 list_for_each_entry_rcu(rule, &chain->rules, list) { 1906 if (!nft_rule_is_active(net, rule)) 1907 goto cont; 1908 if (idx < s_idx) 1909 goto cont; 1910 if (idx > s_idx) 1911 memset(&cb->args[1], 0, 1912 sizeof(cb->args) - sizeof(cb->args[0])); 1913 if (nf_tables_fill_rule_info(skb, net, NETLINK_CB(cb->skb).portid, 1914 cb->nlh->nlmsg_seq, 1915 NFT_MSG_NEWRULE, 1916 NLM_F_MULTI | NLM_F_APPEND, 1917 afi->family, table, chain, rule) < 0) 1918 goto done; 1919 1920 nl_dump_check_consistent(cb, nlmsg_hdr(skb)); 1921 cont: 1922 idx++; 1923 } 1924 } 1925 } 1926 } 1927 done: 1928 rcu_read_unlock(); 1929 1930 cb->args[0] = idx; 1931 return skb->len; 1932 } 1933 1934 static int nf_tables_getrule(struct sock *nlsk, struct sk_buff *skb, 1935 const struct nlmsghdr *nlh, 1936 const struct nlattr * const nla[]) 1937 { 1938 const struct nfgenmsg *nfmsg = nlmsg_data(nlh); 1939 const struct nft_af_info *afi; 1940 const struct nft_table *table; 1941 const struct nft_chain *chain; 1942 const struct nft_rule *rule; 1943 struct sk_buff *skb2; 1944 struct net *net = sock_net(skb->sk); 1945 int family = nfmsg->nfgen_family; 1946 int err; 1947 1948 if (nlh->nlmsg_flags & NLM_F_DUMP) { 1949 struct netlink_dump_control c = { 1950 .dump = nf_tables_dump_rules, 1951 }; 1952 return netlink_dump_start(nlsk, skb, nlh, &c); 1953 } 1954 1955 afi = nf_tables_afinfo_lookup(net, family, false); 1956 if (IS_ERR(afi)) 1957 return PTR_ERR(afi); 1958 1959 table = nf_tables_table_lookup(afi, nla[NFTA_RULE_TABLE]); 1960 if (IS_ERR(table)) 1961 return PTR_ERR(table); 1962 if (table->flags & NFT_TABLE_INACTIVE) 1963 return -ENOENT; 1964 1965 chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN]); 1966 if (IS_ERR(chain)) 1967 return PTR_ERR(chain); 1968 if (chain->flags & NFT_CHAIN_INACTIVE) 1969 return -ENOENT; 1970 1971 rule = nf_tables_rule_lookup(chain, nla[NFTA_RULE_HANDLE]); 1972 if (IS_ERR(rule)) 1973 return PTR_ERR(rule); 1974 1975 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL); 1976 if (!skb2) 1977 return -ENOMEM; 1978 1979 err = nf_tables_fill_rule_info(skb2, net, NETLINK_CB(skb).portid, 1980 nlh->nlmsg_seq, NFT_MSG_NEWRULE, 0, 1981 family, table, chain, rule); 1982 if (err < 0) 1983 goto err; 1984 1985 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid); 1986 1987 err: 1988 kfree_skb(skb2); 1989 return err; 1990 } 1991 1992 static void nf_tables_rule_destroy(const struct nft_ctx *ctx, 1993 struct nft_rule *rule) 1994 { 1995 struct nft_expr *expr; 1996 1997 /* 1998 * Careful: some expressions might not be initialized in case this 1999 * is called on error from nf_tables_newrule(). 2000 */ 2001 expr = nft_expr_first(rule); 2002 while (expr->ops && expr != nft_expr_last(rule)) { 2003 nf_tables_expr_destroy(ctx, expr); 2004 expr = nft_expr_next(expr); 2005 } 2006 kfree(rule); 2007 } 2008 2009 #define NFT_RULE_MAXEXPRS 128 2010 2011 static struct nft_expr_info *info; 2012 2013 static int nf_tables_newrule(struct sock *nlsk, struct sk_buff *skb, 2014 const struct nlmsghdr *nlh, 2015 const struct nlattr * const nla[]) 2016 { 2017 const struct nfgenmsg *nfmsg = nlmsg_data(nlh); 2018 struct nft_af_info *afi; 2019 struct net *net = sock_net(skb->sk); 2020 struct nft_table *table; 2021 struct nft_chain *chain; 2022 struct nft_rule *rule, *old_rule = NULL; 2023 struct nft_userdata *udata; 2024 struct nft_trans *trans = NULL; 2025 struct nft_expr *expr; 2026 struct nft_ctx ctx; 2027 struct nlattr *tmp; 2028 unsigned int size, i, n, ulen = 0, usize = 0; 2029 int err, rem; 2030 bool create; 2031 u64 handle, pos_handle; 2032 2033 create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false; 2034 2035 afi = nf_tables_afinfo_lookup(net, nfmsg->nfgen_family, create); 2036 if (IS_ERR(afi)) 2037 return PTR_ERR(afi); 2038 2039 table = nf_tables_table_lookup(afi, nla[NFTA_RULE_TABLE]); 2040 if (IS_ERR(table)) 2041 return PTR_ERR(table); 2042 2043 chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN]); 2044 if (IS_ERR(chain)) 2045 return PTR_ERR(chain); 2046 2047 if (nla[NFTA_RULE_HANDLE]) { 2048 handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_HANDLE])); 2049 rule = __nf_tables_rule_lookup(chain, handle); 2050 if (IS_ERR(rule)) 2051 return PTR_ERR(rule); 2052 2053 if (nlh->nlmsg_flags & NLM_F_EXCL) 2054 return -EEXIST; 2055 if (nlh->nlmsg_flags & NLM_F_REPLACE) 2056 old_rule = rule; 2057 else 2058 return -EOPNOTSUPP; 2059 } else { 2060 if (!create || nlh->nlmsg_flags & NLM_F_REPLACE) 2061 return -EINVAL; 2062 handle = nf_tables_alloc_handle(table); 2063 2064 if (chain->use == UINT_MAX) 2065 return -EOVERFLOW; 2066 } 2067 2068 if (nla[NFTA_RULE_POSITION]) { 2069 if (!(nlh->nlmsg_flags & NLM_F_CREATE)) 2070 return -EOPNOTSUPP; 2071 2072 pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION])); 2073 old_rule = __nf_tables_rule_lookup(chain, pos_handle); 2074 if (IS_ERR(old_rule)) 2075 return PTR_ERR(old_rule); 2076 } 2077 2078 nft_ctx_init(&ctx, skb, nlh, afi, table, chain, nla); 2079 2080 n = 0; 2081 size = 0; 2082 if (nla[NFTA_RULE_EXPRESSIONS]) { 2083 nla_for_each_nested(tmp, nla[NFTA_RULE_EXPRESSIONS], rem) { 2084 err = -EINVAL; 2085 if (nla_type(tmp) != NFTA_LIST_ELEM) 2086 goto err1; 2087 if (n == NFT_RULE_MAXEXPRS) 2088 goto err1; 2089 err = nf_tables_expr_parse(&ctx, tmp, &info[n]); 2090 if (err < 0) 2091 goto err1; 2092 size += info[n].ops->size; 2093 n++; 2094 } 2095 } 2096 /* Check for overflow of dlen field */ 2097 err = -EFBIG; 2098 if (size >= 1 << 12) 2099 goto err1; 2100 2101 if (nla[NFTA_RULE_USERDATA]) { 2102 ulen = nla_len(nla[NFTA_RULE_USERDATA]); 2103 if (ulen > 0) 2104 usize = sizeof(struct nft_userdata) + ulen; 2105 } 2106 2107 err = -ENOMEM; 2108 rule = kzalloc(sizeof(*rule) + size + usize, GFP_KERNEL); 2109 if (rule == NULL) 2110 goto err1; 2111 2112 nft_rule_activate_next(net, rule); 2113 2114 rule->handle = handle; 2115 rule->dlen = size; 2116 rule->udata = ulen ? 1 : 0; 2117 2118 if (ulen) { 2119 udata = nft_userdata(rule); 2120 udata->len = ulen - 1; 2121 nla_memcpy(udata->data, nla[NFTA_RULE_USERDATA], ulen); 2122 } 2123 2124 expr = nft_expr_first(rule); 2125 for (i = 0; i < n; i++) { 2126 err = nf_tables_newexpr(&ctx, &info[i], expr); 2127 if (err < 0) 2128 goto err2; 2129 info[i].ops = NULL; 2130 expr = nft_expr_next(expr); 2131 } 2132 2133 if (nlh->nlmsg_flags & NLM_F_REPLACE) { 2134 if (nft_rule_is_active_next(net, old_rule)) { 2135 trans = nft_trans_rule_add(&ctx, NFT_MSG_DELRULE, 2136 old_rule); 2137 if (trans == NULL) { 2138 err = -ENOMEM; 2139 goto err2; 2140 } 2141 nft_rule_deactivate_next(net, old_rule); 2142 chain->use--; 2143 list_add_tail_rcu(&rule->list, &old_rule->list); 2144 } else { 2145 err = -ENOENT; 2146 goto err2; 2147 } 2148 } else if (nlh->nlmsg_flags & NLM_F_APPEND) 2149 if (old_rule) 2150 list_add_rcu(&rule->list, &old_rule->list); 2151 else 2152 list_add_tail_rcu(&rule->list, &chain->rules); 2153 else { 2154 if (old_rule) 2155 list_add_tail_rcu(&rule->list, &old_rule->list); 2156 else 2157 list_add_rcu(&rule->list, &chain->rules); 2158 } 2159 2160 if (nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule) == NULL) { 2161 err = -ENOMEM; 2162 goto err3; 2163 } 2164 chain->use++; 2165 return 0; 2166 2167 err3: 2168 list_del_rcu(&rule->list); 2169 err2: 2170 nf_tables_rule_destroy(&ctx, rule); 2171 err1: 2172 for (i = 0; i < n; i++) { 2173 if (info[i].ops != NULL) 2174 module_put(info[i].ops->type->owner); 2175 } 2176 return err; 2177 } 2178 2179 static int nf_tables_delrule(struct sock *nlsk, struct sk_buff *skb, 2180 const struct nlmsghdr *nlh, 2181 const struct nlattr * const nla[]) 2182 { 2183 const struct nfgenmsg *nfmsg = nlmsg_data(nlh); 2184 struct nft_af_info *afi; 2185 struct net *net = sock_net(skb->sk); 2186 struct nft_table *table; 2187 struct nft_chain *chain = NULL; 2188 struct nft_rule *rule; 2189 int family = nfmsg->nfgen_family, err = 0; 2190 struct nft_ctx ctx; 2191 2192 afi = nf_tables_afinfo_lookup(net, family, false); 2193 if (IS_ERR(afi)) 2194 return PTR_ERR(afi); 2195 2196 table = nf_tables_table_lookup(afi, nla[NFTA_RULE_TABLE]); 2197 if (IS_ERR(table)) 2198 return PTR_ERR(table); 2199 if (table->flags & NFT_TABLE_INACTIVE) 2200 return -ENOENT; 2201 2202 if (nla[NFTA_RULE_CHAIN]) { 2203 chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN]); 2204 if (IS_ERR(chain)) 2205 return PTR_ERR(chain); 2206 } 2207 2208 nft_ctx_init(&ctx, skb, nlh, afi, table, chain, nla); 2209 2210 if (chain) { 2211 if (nla[NFTA_RULE_HANDLE]) { 2212 rule = nf_tables_rule_lookup(chain, 2213 nla[NFTA_RULE_HANDLE]); 2214 if (IS_ERR(rule)) 2215 return PTR_ERR(rule); 2216 2217 err = nft_delrule(&ctx, rule); 2218 } else { 2219 err = nft_delrule_by_chain(&ctx); 2220 } 2221 } else { 2222 list_for_each_entry(chain, &table->chains, list) { 2223 ctx.chain = chain; 2224 err = nft_delrule_by_chain(&ctx); 2225 if (err < 0) 2226 break; 2227 } 2228 } 2229 2230 return err; 2231 } 2232 2233 /* 2234 * Sets 2235 */ 2236 2237 static LIST_HEAD(nf_tables_set_ops); 2238 2239 int nft_register_set(struct nft_set_ops *ops) 2240 { 2241 nfnl_lock(NFNL_SUBSYS_NFTABLES); 2242 list_add_tail_rcu(&ops->list, &nf_tables_set_ops); 2243 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 2244 return 0; 2245 } 2246 EXPORT_SYMBOL_GPL(nft_register_set); 2247 2248 void nft_unregister_set(struct nft_set_ops *ops) 2249 { 2250 nfnl_lock(NFNL_SUBSYS_NFTABLES); 2251 list_del_rcu(&ops->list); 2252 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 2253 } 2254 EXPORT_SYMBOL_GPL(nft_unregister_set); 2255 2256 /* 2257 * Select a set implementation based on the data characteristics and the 2258 * given policy. The total memory use might not be known if no size is 2259 * given, in that case the amount of memory per element is used. 2260 */ 2261 static const struct nft_set_ops * 2262 nft_select_set_ops(const struct nlattr * const nla[], 2263 const struct nft_set_desc *desc, 2264 enum nft_set_policies policy) 2265 { 2266 const struct nft_set_ops *ops, *bops; 2267 struct nft_set_estimate est, best; 2268 u32 features; 2269 2270 #ifdef CONFIG_MODULES 2271 if (list_empty(&nf_tables_set_ops)) { 2272 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 2273 request_module("nft-set"); 2274 nfnl_lock(NFNL_SUBSYS_NFTABLES); 2275 if (!list_empty(&nf_tables_set_ops)) 2276 return ERR_PTR(-EAGAIN); 2277 } 2278 #endif 2279 features = 0; 2280 if (nla[NFTA_SET_FLAGS] != NULL) { 2281 features = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS])); 2282 features &= NFT_SET_INTERVAL | NFT_SET_MAP | NFT_SET_TIMEOUT; 2283 } 2284 2285 bops = NULL; 2286 best.size = ~0; 2287 best.class = ~0; 2288 2289 list_for_each_entry(ops, &nf_tables_set_ops, list) { 2290 if ((ops->features & features) != features) 2291 continue; 2292 if (!ops->estimate(desc, features, &est)) 2293 continue; 2294 2295 switch (policy) { 2296 case NFT_SET_POL_PERFORMANCE: 2297 if (est.class < best.class) 2298 break; 2299 if (est.class == best.class && est.size < best.size) 2300 break; 2301 continue; 2302 case NFT_SET_POL_MEMORY: 2303 if (est.size < best.size) 2304 break; 2305 if (est.size == best.size && est.class < best.class) 2306 break; 2307 continue; 2308 default: 2309 break; 2310 } 2311 2312 if (!try_module_get(ops->owner)) 2313 continue; 2314 if (bops != NULL) 2315 module_put(bops->owner); 2316 2317 bops = ops; 2318 best = est; 2319 } 2320 2321 if (bops != NULL) 2322 return bops; 2323 2324 return ERR_PTR(-EOPNOTSUPP); 2325 } 2326 2327 static const struct nla_policy nft_set_policy[NFTA_SET_MAX + 1] = { 2328 [NFTA_SET_TABLE] = { .type = NLA_STRING }, 2329 [NFTA_SET_NAME] = { .type = NLA_STRING, 2330 .len = IFNAMSIZ - 1 }, 2331 [NFTA_SET_FLAGS] = { .type = NLA_U32 }, 2332 [NFTA_SET_KEY_TYPE] = { .type = NLA_U32 }, 2333 [NFTA_SET_KEY_LEN] = { .type = NLA_U32 }, 2334 [NFTA_SET_DATA_TYPE] = { .type = NLA_U32 }, 2335 [NFTA_SET_DATA_LEN] = { .type = NLA_U32 }, 2336 [NFTA_SET_POLICY] = { .type = NLA_U32 }, 2337 [NFTA_SET_DESC] = { .type = NLA_NESTED }, 2338 [NFTA_SET_ID] = { .type = NLA_U32 }, 2339 [NFTA_SET_TIMEOUT] = { .type = NLA_U64 }, 2340 [NFTA_SET_GC_INTERVAL] = { .type = NLA_U32 }, 2341 }; 2342 2343 static const struct nla_policy nft_set_desc_policy[NFTA_SET_DESC_MAX + 1] = { 2344 [NFTA_SET_DESC_SIZE] = { .type = NLA_U32 }, 2345 }; 2346 2347 static int nft_ctx_init_from_setattr(struct nft_ctx *ctx, 2348 const struct sk_buff *skb, 2349 const struct nlmsghdr *nlh, 2350 const struct nlattr * const nla[]) 2351 { 2352 struct net *net = sock_net(skb->sk); 2353 const struct nfgenmsg *nfmsg = nlmsg_data(nlh); 2354 struct nft_af_info *afi = NULL; 2355 struct nft_table *table = NULL; 2356 2357 if (nfmsg->nfgen_family != NFPROTO_UNSPEC) { 2358 afi = nf_tables_afinfo_lookup(net, nfmsg->nfgen_family, false); 2359 if (IS_ERR(afi)) 2360 return PTR_ERR(afi); 2361 } 2362 2363 if (nla[NFTA_SET_TABLE] != NULL) { 2364 if (afi == NULL) 2365 return -EAFNOSUPPORT; 2366 2367 table = nf_tables_table_lookup(afi, nla[NFTA_SET_TABLE]); 2368 if (IS_ERR(table)) 2369 return PTR_ERR(table); 2370 if (table->flags & NFT_TABLE_INACTIVE) 2371 return -ENOENT; 2372 } 2373 2374 nft_ctx_init(ctx, skb, nlh, afi, table, NULL, nla); 2375 return 0; 2376 } 2377 2378 struct nft_set *nf_tables_set_lookup(const struct nft_table *table, 2379 const struct nlattr *nla) 2380 { 2381 struct nft_set *set; 2382 2383 if (nla == NULL) 2384 return ERR_PTR(-EINVAL); 2385 2386 list_for_each_entry(set, &table->sets, list) { 2387 if (!nla_strcmp(nla, set->name)) 2388 return set; 2389 } 2390 return ERR_PTR(-ENOENT); 2391 } 2392 2393 struct nft_set *nf_tables_set_lookup_byid(const struct net *net, 2394 const struct nlattr *nla) 2395 { 2396 struct nft_trans *trans; 2397 u32 id = ntohl(nla_get_be32(nla)); 2398 2399 list_for_each_entry(trans, &net->nft.commit_list, list) { 2400 if (trans->msg_type == NFT_MSG_NEWSET && 2401 id == nft_trans_set_id(trans)) 2402 return nft_trans_set(trans); 2403 } 2404 return ERR_PTR(-ENOENT); 2405 } 2406 2407 static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set, 2408 const char *name) 2409 { 2410 const struct nft_set *i; 2411 const char *p; 2412 unsigned long *inuse; 2413 unsigned int n = 0, min = 0; 2414 2415 p = strnchr(name, IFNAMSIZ, '%'); 2416 if (p != NULL) { 2417 if (p[1] != 'd' || strchr(p + 2, '%')) 2418 return -EINVAL; 2419 2420 inuse = (unsigned long *)get_zeroed_page(GFP_KERNEL); 2421 if (inuse == NULL) 2422 return -ENOMEM; 2423 cont: 2424 list_for_each_entry(i, &ctx->table->sets, list) { 2425 int tmp; 2426 2427 if (!sscanf(i->name, name, &tmp)) 2428 continue; 2429 if (tmp < min || tmp >= min + BITS_PER_BYTE * PAGE_SIZE) 2430 continue; 2431 2432 set_bit(tmp - min, inuse); 2433 } 2434 2435 n = find_first_zero_bit(inuse, BITS_PER_BYTE * PAGE_SIZE); 2436 if (n >= BITS_PER_BYTE * PAGE_SIZE) { 2437 min += BITS_PER_BYTE * PAGE_SIZE; 2438 memset(inuse, 0, PAGE_SIZE); 2439 goto cont; 2440 } 2441 free_page((unsigned long)inuse); 2442 } 2443 2444 snprintf(set->name, sizeof(set->name), name, min + n); 2445 list_for_each_entry(i, &ctx->table->sets, list) { 2446 if (!strcmp(set->name, i->name)) 2447 return -ENFILE; 2448 } 2449 return 0; 2450 } 2451 2452 static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx, 2453 const struct nft_set *set, u16 event, u16 flags) 2454 { 2455 struct nfgenmsg *nfmsg; 2456 struct nlmsghdr *nlh; 2457 struct nlattr *desc; 2458 u32 portid = ctx->portid; 2459 u32 seq = ctx->seq; 2460 2461 event |= NFNL_SUBSYS_NFTABLES << 8; 2462 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), 2463 flags); 2464 if (nlh == NULL) 2465 goto nla_put_failure; 2466 2467 nfmsg = nlmsg_data(nlh); 2468 nfmsg->nfgen_family = ctx->afi->family; 2469 nfmsg->version = NFNETLINK_V0; 2470 nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff); 2471 2472 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name)) 2473 goto nla_put_failure; 2474 if (nla_put_string(skb, NFTA_SET_NAME, set->name)) 2475 goto nla_put_failure; 2476 if (set->flags != 0) 2477 if (nla_put_be32(skb, NFTA_SET_FLAGS, htonl(set->flags))) 2478 goto nla_put_failure; 2479 2480 if (nla_put_be32(skb, NFTA_SET_KEY_TYPE, htonl(set->ktype))) 2481 goto nla_put_failure; 2482 if (nla_put_be32(skb, NFTA_SET_KEY_LEN, htonl(set->klen))) 2483 goto nla_put_failure; 2484 if (set->flags & NFT_SET_MAP) { 2485 if (nla_put_be32(skb, NFTA_SET_DATA_TYPE, htonl(set->dtype))) 2486 goto nla_put_failure; 2487 if (nla_put_be32(skb, NFTA_SET_DATA_LEN, htonl(set->dlen))) 2488 goto nla_put_failure; 2489 } 2490 2491 if (set->timeout && 2492 nla_put_be64(skb, NFTA_SET_TIMEOUT, cpu_to_be64(set->timeout))) 2493 goto nla_put_failure; 2494 if (set->gc_int && 2495 nla_put_be32(skb, NFTA_SET_GC_INTERVAL, htonl(set->gc_int))) 2496 goto nla_put_failure; 2497 2498 if (set->policy != NFT_SET_POL_PERFORMANCE) { 2499 if (nla_put_be32(skb, NFTA_SET_POLICY, htonl(set->policy))) 2500 goto nla_put_failure; 2501 } 2502 2503 desc = nla_nest_start(skb, NFTA_SET_DESC); 2504 if (desc == NULL) 2505 goto nla_put_failure; 2506 if (set->size && 2507 nla_put_be32(skb, NFTA_SET_DESC_SIZE, htonl(set->size))) 2508 goto nla_put_failure; 2509 nla_nest_end(skb, desc); 2510 2511 nlmsg_end(skb, nlh); 2512 return 0; 2513 2514 nla_put_failure: 2515 nlmsg_trim(skb, nlh); 2516 return -1; 2517 } 2518 2519 static int nf_tables_set_notify(const struct nft_ctx *ctx, 2520 const struct nft_set *set, 2521 int event, gfp_t gfp_flags) 2522 { 2523 struct sk_buff *skb; 2524 u32 portid = ctx->portid; 2525 int err; 2526 2527 if (!ctx->report && 2528 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) 2529 return 0; 2530 2531 err = -ENOBUFS; 2532 skb = nlmsg_new(NLMSG_GOODSIZE, gfp_flags); 2533 if (skb == NULL) 2534 goto err; 2535 2536 err = nf_tables_fill_set(skb, ctx, set, event, 0); 2537 if (err < 0) { 2538 kfree_skb(skb); 2539 goto err; 2540 } 2541 2542 err = nfnetlink_send(skb, ctx->net, portid, NFNLGRP_NFTABLES, 2543 ctx->report, gfp_flags); 2544 err: 2545 if (err < 0) 2546 nfnetlink_set_err(ctx->net, portid, NFNLGRP_NFTABLES, err); 2547 return err; 2548 } 2549 2550 static int nf_tables_dump_sets(struct sk_buff *skb, struct netlink_callback *cb) 2551 { 2552 const struct nft_set *set; 2553 unsigned int idx, s_idx = cb->args[0]; 2554 struct nft_af_info *afi; 2555 struct nft_table *table, *cur_table = (struct nft_table *)cb->args[2]; 2556 struct net *net = sock_net(skb->sk); 2557 int cur_family = cb->args[3]; 2558 struct nft_ctx *ctx = cb->data, ctx_set; 2559 2560 if (cb->args[1]) 2561 return skb->len; 2562 2563 rcu_read_lock(); 2564 cb->seq = net->nft.base_seq; 2565 2566 list_for_each_entry_rcu(afi, &net->nft.af_info, list) { 2567 if (ctx->afi && ctx->afi != afi) 2568 continue; 2569 2570 if (cur_family) { 2571 if (afi->family != cur_family) 2572 continue; 2573 2574 cur_family = 0; 2575 } 2576 list_for_each_entry_rcu(table, &afi->tables, list) { 2577 if (ctx->table && ctx->table != table) 2578 continue; 2579 2580 if (cur_table) { 2581 if (cur_table != table) 2582 continue; 2583 2584 cur_table = NULL; 2585 } 2586 idx = 0; 2587 list_for_each_entry_rcu(set, &table->sets, list) { 2588 if (idx < s_idx) 2589 goto cont; 2590 2591 ctx_set = *ctx; 2592 ctx_set.table = table; 2593 ctx_set.afi = afi; 2594 if (nf_tables_fill_set(skb, &ctx_set, set, 2595 NFT_MSG_NEWSET, 2596 NLM_F_MULTI) < 0) { 2597 cb->args[0] = idx; 2598 cb->args[2] = (unsigned long) table; 2599 cb->args[3] = afi->family; 2600 goto done; 2601 } 2602 nl_dump_check_consistent(cb, nlmsg_hdr(skb)); 2603 cont: 2604 idx++; 2605 } 2606 if (s_idx) 2607 s_idx = 0; 2608 } 2609 } 2610 cb->args[1] = 1; 2611 done: 2612 rcu_read_unlock(); 2613 return skb->len; 2614 } 2615 2616 static int nf_tables_dump_sets_done(struct netlink_callback *cb) 2617 { 2618 kfree(cb->data); 2619 return 0; 2620 } 2621 2622 static int nf_tables_getset(struct sock *nlsk, struct sk_buff *skb, 2623 const struct nlmsghdr *nlh, 2624 const struct nlattr * const nla[]) 2625 { 2626 const struct nft_set *set; 2627 struct nft_ctx ctx; 2628 struct sk_buff *skb2; 2629 const struct nfgenmsg *nfmsg = nlmsg_data(nlh); 2630 int err; 2631 2632 /* Verify existence before starting dump */ 2633 err = nft_ctx_init_from_setattr(&ctx, skb, nlh, nla); 2634 if (err < 0) 2635 return err; 2636 2637 if (nlh->nlmsg_flags & NLM_F_DUMP) { 2638 struct netlink_dump_control c = { 2639 .dump = nf_tables_dump_sets, 2640 .done = nf_tables_dump_sets_done, 2641 }; 2642 struct nft_ctx *ctx_dump; 2643 2644 ctx_dump = kmalloc(sizeof(*ctx_dump), GFP_KERNEL); 2645 if (ctx_dump == NULL) 2646 return -ENOMEM; 2647 2648 *ctx_dump = ctx; 2649 c.data = ctx_dump; 2650 2651 return netlink_dump_start(nlsk, skb, nlh, &c); 2652 } 2653 2654 /* Only accept unspec with dump */ 2655 if (nfmsg->nfgen_family == NFPROTO_UNSPEC) 2656 return -EAFNOSUPPORT; 2657 2658 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_NAME]); 2659 if (IS_ERR(set)) 2660 return PTR_ERR(set); 2661 if (set->flags & NFT_SET_INACTIVE) 2662 return -ENOENT; 2663 2664 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL); 2665 if (skb2 == NULL) 2666 return -ENOMEM; 2667 2668 err = nf_tables_fill_set(skb2, &ctx, set, NFT_MSG_NEWSET, 0); 2669 if (err < 0) 2670 goto err; 2671 2672 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid); 2673 2674 err: 2675 kfree_skb(skb2); 2676 return err; 2677 } 2678 2679 static int nf_tables_set_desc_parse(const struct nft_ctx *ctx, 2680 struct nft_set_desc *desc, 2681 const struct nlattr *nla) 2682 { 2683 struct nlattr *da[NFTA_SET_DESC_MAX + 1]; 2684 int err; 2685 2686 err = nla_parse_nested(da, NFTA_SET_DESC_MAX, nla, nft_set_desc_policy); 2687 if (err < 0) 2688 return err; 2689 2690 if (da[NFTA_SET_DESC_SIZE] != NULL) 2691 desc->size = ntohl(nla_get_be32(da[NFTA_SET_DESC_SIZE])); 2692 2693 return 0; 2694 } 2695 2696 static int nf_tables_newset(struct sock *nlsk, struct sk_buff *skb, 2697 const struct nlmsghdr *nlh, 2698 const struct nlattr * const nla[]) 2699 { 2700 const struct nfgenmsg *nfmsg = nlmsg_data(nlh); 2701 const struct nft_set_ops *ops; 2702 struct nft_af_info *afi; 2703 struct net *net = sock_net(skb->sk); 2704 struct nft_table *table; 2705 struct nft_set *set; 2706 struct nft_ctx ctx; 2707 char name[IFNAMSIZ]; 2708 unsigned int size; 2709 bool create; 2710 u64 timeout; 2711 u32 ktype, dtype, flags, policy, gc_int; 2712 struct nft_set_desc desc; 2713 int err; 2714 2715 if (nla[NFTA_SET_TABLE] == NULL || 2716 nla[NFTA_SET_NAME] == NULL || 2717 nla[NFTA_SET_KEY_LEN] == NULL || 2718 nla[NFTA_SET_ID] == NULL) 2719 return -EINVAL; 2720 2721 memset(&desc, 0, sizeof(desc)); 2722 2723 ktype = NFT_DATA_VALUE; 2724 if (nla[NFTA_SET_KEY_TYPE] != NULL) { 2725 ktype = ntohl(nla_get_be32(nla[NFTA_SET_KEY_TYPE])); 2726 if ((ktype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK) 2727 return -EINVAL; 2728 } 2729 2730 desc.klen = ntohl(nla_get_be32(nla[NFTA_SET_KEY_LEN])); 2731 if (desc.klen == 0 || desc.klen > NFT_DATA_VALUE_MAXLEN) 2732 return -EINVAL; 2733 2734 flags = 0; 2735 if (nla[NFTA_SET_FLAGS] != NULL) { 2736 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS])); 2737 if (flags & ~(NFT_SET_ANONYMOUS | NFT_SET_CONSTANT | 2738 NFT_SET_INTERVAL | NFT_SET_TIMEOUT | 2739 NFT_SET_MAP | NFT_SET_EVAL)) 2740 return -EINVAL; 2741 /* Only one of both operations is supported */ 2742 if ((flags & (NFT_SET_MAP | NFT_SET_EVAL)) == 2743 (NFT_SET_MAP | NFT_SET_EVAL)) 2744 return -EOPNOTSUPP; 2745 } 2746 2747 dtype = 0; 2748 if (nla[NFTA_SET_DATA_TYPE] != NULL) { 2749 if (!(flags & NFT_SET_MAP)) 2750 return -EINVAL; 2751 2752 dtype = ntohl(nla_get_be32(nla[NFTA_SET_DATA_TYPE])); 2753 if ((dtype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK && 2754 dtype != NFT_DATA_VERDICT) 2755 return -EINVAL; 2756 2757 if (dtype != NFT_DATA_VERDICT) { 2758 if (nla[NFTA_SET_DATA_LEN] == NULL) 2759 return -EINVAL; 2760 desc.dlen = ntohl(nla_get_be32(nla[NFTA_SET_DATA_LEN])); 2761 if (desc.dlen == 0 || desc.dlen > NFT_DATA_VALUE_MAXLEN) 2762 return -EINVAL; 2763 } else 2764 desc.dlen = sizeof(struct nft_verdict); 2765 } else if (flags & NFT_SET_MAP) 2766 return -EINVAL; 2767 2768 timeout = 0; 2769 if (nla[NFTA_SET_TIMEOUT] != NULL) { 2770 if (!(flags & NFT_SET_TIMEOUT)) 2771 return -EINVAL; 2772 timeout = be64_to_cpu(nla_get_be64(nla[NFTA_SET_TIMEOUT])); 2773 } 2774 gc_int = 0; 2775 if (nla[NFTA_SET_GC_INTERVAL] != NULL) { 2776 if (!(flags & NFT_SET_TIMEOUT)) 2777 return -EINVAL; 2778 gc_int = ntohl(nla_get_be32(nla[NFTA_SET_GC_INTERVAL])); 2779 } 2780 2781 policy = NFT_SET_POL_PERFORMANCE; 2782 if (nla[NFTA_SET_POLICY] != NULL) 2783 policy = ntohl(nla_get_be32(nla[NFTA_SET_POLICY])); 2784 2785 if (nla[NFTA_SET_DESC] != NULL) { 2786 err = nf_tables_set_desc_parse(&ctx, &desc, nla[NFTA_SET_DESC]); 2787 if (err < 0) 2788 return err; 2789 } 2790 2791 create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false; 2792 2793 afi = nf_tables_afinfo_lookup(net, nfmsg->nfgen_family, create); 2794 if (IS_ERR(afi)) 2795 return PTR_ERR(afi); 2796 2797 table = nf_tables_table_lookup(afi, nla[NFTA_SET_TABLE]); 2798 if (IS_ERR(table)) 2799 return PTR_ERR(table); 2800 2801 nft_ctx_init(&ctx, skb, nlh, afi, table, NULL, nla); 2802 2803 set = nf_tables_set_lookup(table, nla[NFTA_SET_NAME]); 2804 if (IS_ERR(set)) { 2805 if (PTR_ERR(set) != -ENOENT) 2806 return PTR_ERR(set); 2807 set = NULL; 2808 } 2809 2810 if (set != NULL) { 2811 if (nlh->nlmsg_flags & NLM_F_EXCL) 2812 return -EEXIST; 2813 if (nlh->nlmsg_flags & NLM_F_REPLACE) 2814 return -EOPNOTSUPP; 2815 return 0; 2816 } 2817 2818 if (!(nlh->nlmsg_flags & NLM_F_CREATE)) 2819 return -ENOENT; 2820 2821 ops = nft_select_set_ops(nla, &desc, policy); 2822 if (IS_ERR(ops)) 2823 return PTR_ERR(ops); 2824 2825 size = 0; 2826 if (ops->privsize != NULL) 2827 size = ops->privsize(nla); 2828 2829 err = -ENOMEM; 2830 set = kzalloc(sizeof(*set) + size, GFP_KERNEL); 2831 if (set == NULL) 2832 goto err1; 2833 2834 nla_strlcpy(name, nla[NFTA_SET_NAME], sizeof(set->name)); 2835 err = nf_tables_set_alloc_name(&ctx, set, name); 2836 if (err < 0) 2837 goto err2; 2838 2839 INIT_LIST_HEAD(&set->bindings); 2840 write_pnet(&set->pnet, net); 2841 set->ops = ops; 2842 set->ktype = ktype; 2843 set->klen = desc.klen; 2844 set->dtype = dtype; 2845 set->dlen = desc.dlen; 2846 set->flags = flags; 2847 set->size = desc.size; 2848 set->policy = policy; 2849 set->timeout = timeout; 2850 set->gc_int = gc_int; 2851 2852 err = ops->init(set, &desc, nla); 2853 if (err < 0) 2854 goto err2; 2855 2856 err = nft_trans_set_add(&ctx, NFT_MSG_NEWSET, set); 2857 if (err < 0) 2858 goto err2; 2859 2860 list_add_tail_rcu(&set->list, &table->sets); 2861 table->use++; 2862 return 0; 2863 2864 err2: 2865 kfree(set); 2866 err1: 2867 module_put(ops->owner); 2868 return err; 2869 } 2870 2871 static void nft_set_destroy(struct nft_set *set) 2872 { 2873 set->ops->destroy(set); 2874 module_put(set->ops->owner); 2875 kfree(set); 2876 } 2877 2878 static void nf_tables_set_destroy(const struct nft_ctx *ctx, struct nft_set *set) 2879 { 2880 list_del_rcu(&set->list); 2881 nf_tables_set_notify(ctx, set, NFT_MSG_DELSET, GFP_ATOMIC); 2882 nft_set_destroy(set); 2883 } 2884 2885 static int nf_tables_delset(struct sock *nlsk, struct sk_buff *skb, 2886 const struct nlmsghdr *nlh, 2887 const struct nlattr * const nla[]) 2888 { 2889 const struct nfgenmsg *nfmsg = nlmsg_data(nlh); 2890 struct nft_set *set; 2891 struct nft_ctx ctx; 2892 int err; 2893 2894 if (nfmsg->nfgen_family == NFPROTO_UNSPEC) 2895 return -EAFNOSUPPORT; 2896 if (nla[NFTA_SET_TABLE] == NULL) 2897 return -EINVAL; 2898 2899 err = nft_ctx_init_from_setattr(&ctx, skb, nlh, nla); 2900 if (err < 0) 2901 return err; 2902 2903 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_NAME]); 2904 if (IS_ERR(set)) 2905 return PTR_ERR(set); 2906 if (set->flags & NFT_SET_INACTIVE) 2907 return -ENOENT; 2908 if (!list_empty(&set->bindings)) 2909 return -EBUSY; 2910 2911 return nft_delset(&ctx, set); 2912 } 2913 2914 static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx, 2915 const struct nft_set *set, 2916 const struct nft_set_iter *iter, 2917 const struct nft_set_elem *elem) 2918 { 2919 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); 2920 enum nft_registers dreg; 2921 2922 dreg = nft_type_to_reg(set->dtype); 2923 return nft_validate_register_store(ctx, dreg, nft_set_ext_data(ext), 2924 set->dtype == NFT_DATA_VERDICT ? 2925 NFT_DATA_VERDICT : NFT_DATA_VALUE, 2926 set->dlen); 2927 } 2928 2929 int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set, 2930 struct nft_set_binding *binding) 2931 { 2932 struct nft_set_binding *i; 2933 struct nft_set_iter iter; 2934 2935 if (!list_empty(&set->bindings) && set->flags & NFT_SET_ANONYMOUS) 2936 return -EBUSY; 2937 2938 if (binding->flags & NFT_SET_MAP) { 2939 /* If the set is already bound to the same chain all 2940 * jumps are already validated for that chain. 2941 */ 2942 list_for_each_entry(i, &set->bindings, list) { 2943 if (binding->flags & NFT_SET_MAP && 2944 i->chain == binding->chain) 2945 goto bind; 2946 } 2947 2948 iter.skip = 0; 2949 iter.count = 0; 2950 iter.err = 0; 2951 iter.fn = nf_tables_bind_check_setelem; 2952 2953 set->ops->walk(ctx, set, &iter); 2954 if (iter.err < 0) { 2955 /* Destroy anonymous sets if binding fails */ 2956 if (set->flags & NFT_SET_ANONYMOUS) 2957 nf_tables_set_destroy(ctx, set); 2958 2959 return iter.err; 2960 } 2961 } 2962 bind: 2963 binding->chain = ctx->chain; 2964 list_add_tail_rcu(&binding->list, &set->bindings); 2965 return 0; 2966 } 2967 2968 void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set, 2969 struct nft_set_binding *binding) 2970 { 2971 list_del_rcu(&binding->list); 2972 2973 if (list_empty(&set->bindings) && set->flags & NFT_SET_ANONYMOUS && 2974 !(set->flags & NFT_SET_INACTIVE)) 2975 nf_tables_set_destroy(ctx, set); 2976 } 2977 2978 const struct nft_set_ext_type nft_set_ext_types[] = { 2979 [NFT_SET_EXT_KEY] = { 2980 .align = __alignof__(u32), 2981 }, 2982 [NFT_SET_EXT_DATA] = { 2983 .align = __alignof__(u32), 2984 }, 2985 [NFT_SET_EXT_EXPR] = { 2986 .align = __alignof__(struct nft_expr), 2987 }, 2988 [NFT_SET_EXT_FLAGS] = { 2989 .len = sizeof(u8), 2990 .align = __alignof__(u8), 2991 }, 2992 [NFT_SET_EXT_TIMEOUT] = { 2993 .len = sizeof(u64), 2994 .align = __alignof__(u64), 2995 }, 2996 [NFT_SET_EXT_EXPIRATION] = { 2997 .len = sizeof(unsigned long), 2998 .align = __alignof__(unsigned long), 2999 }, 3000 [NFT_SET_EXT_USERDATA] = { 3001 .len = sizeof(struct nft_userdata), 3002 .align = __alignof__(struct nft_userdata), 3003 }, 3004 }; 3005 EXPORT_SYMBOL_GPL(nft_set_ext_types); 3006 3007 /* 3008 * Set elements 3009 */ 3010 3011 static const struct nla_policy nft_set_elem_policy[NFTA_SET_ELEM_MAX + 1] = { 3012 [NFTA_SET_ELEM_KEY] = { .type = NLA_NESTED }, 3013 [NFTA_SET_ELEM_DATA] = { .type = NLA_NESTED }, 3014 [NFTA_SET_ELEM_FLAGS] = { .type = NLA_U32 }, 3015 [NFTA_SET_ELEM_TIMEOUT] = { .type = NLA_U64 }, 3016 [NFTA_SET_ELEM_USERDATA] = { .type = NLA_BINARY, 3017 .len = NFT_USERDATA_MAXLEN }, 3018 }; 3019 3020 static const struct nla_policy nft_set_elem_list_policy[NFTA_SET_ELEM_LIST_MAX + 1] = { 3021 [NFTA_SET_ELEM_LIST_TABLE] = { .type = NLA_STRING }, 3022 [NFTA_SET_ELEM_LIST_SET] = { .type = NLA_STRING }, 3023 [NFTA_SET_ELEM_LIST_ELEMENTS] = { .type = NLA_NESTED }, 3024 [NFTA_SET_ELEM_LIST_SET_ID] = { .type = NLA_U32 }, 3025 }; 3026 3027 static int nft_ctx_init_from_elemattr(struct nft_ctx *ctx, 3028 const struct sk_buff *skb, 3029 const struct nlmsghdr *nlh, 3030 const struct nlattr * const nla[], 3031 bool trans) 3032 { 3033 const struct nfgenmsg *nfmsg = nlmsg_data(nlh); 3034 struct nft_af_info *afi; 3035 struct nft_table *table; 3036 struct net *net = sock_net(skb->sk); 3037 3038 afi = nf_tables_afinfo_lookup(net, nfmsg->nfgen_family, false); 3039 if (IS_ERR(afi)) 3040 return PTR_ERR(afi); 3041 3042 table = nf_tables_table_lookup(afi, nla[NFTA_SET_ELEM_LIST_TABLE]); 3043 if (IS_ERR(table)) 3044 return PTR_ERR(table); 3045 if (!trans && (table->flags & NFT_TABLE_INACTIVE)) 3046 return -ENOENT; 3047 3048 nft_ctx_init(ctx, skb, nlh, afi, table, NULL, nla); 3049 return 0; 3050 } 3051 3052 static int nf_tables_fill_setelem(struct sk_buff *skb, 3053 const struct nft_set *set, 3054 const struct nft_set_elem *elem) 3055 { 3056 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); 3057 unsigned char *b = skb_tail_pointer(skb); 3058 struct nlattr *nest; 3059 3060 nest = nla_nest_start(skb, NFTA_LIST_ELEM); 3061 if (nest == NULL) 3062 goto nla_put_failure; 3063 3064 if (nft_data_dump(skb, NFTA_SET_ELEM_KEY, nft_set_ext_key(ext), 3065 NFT_DATA_VALUE, set->klen) < 0) 3066 goto nla_put_failure; 3067 3068 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) && 3069 nft_data_dump(skb, NFTA_SET_ELEM_DATA, nft_set_ext_data(ext), 3070 set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE, 3071 set->dlen) < 0) 3072 goto nla_put_failure; 3073 3074 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR) && 3075 nft_expr_dump(skb, NFTA_SET_ELEM_EXPR, nft_set_ext_expr(ext)) < 0) 3076 goto nla_put_failure; 3077 3078 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) && 3079 nla_put_be32(skb, NFTA_SET_ELEM_FLAGS, 3080 htonl(*nft_set_ext_flags(ext)))) 3081 goto nla_put_failure; 3082 3083 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT) && 3084 nla_put_be64(skb, NFTA_SET_ELEM_TIMEOUT, 3085 cpu_to_be64(*nft_set_ext_timeout(ext)))) 3086 goto nla_put_failure; 3087 3088 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) { 3089 unsigned long expires, now = jiffies; 3090 3091 expires = *nft_set_ext_expiration(ext); 3092 if (time_before(now, expires)) 3093 expires -= now; 3094 else 3095 expires = 0; 3096 3097 if (nla_put_be64(skb, NFTA_SET_ELEM_EXPIRATION, 3098 cpu_to_be64(jiffies_to_msecs(expires)))) 3099 goto nla_put_failure; 3100 } 3101 3102 if (nft_set_ext_exists(ext, NFT_SET_EXT_USERDATA)) { 3103 struct nft_userdata *udata; 3104 3105 udata = nft_set_ext_userdata(ext); 3106 if (nla_put(skb, NFTA_SET_ELEM_USERDATA, 3107 udata->len + 1, udata->data)) 3108 goto nla_put_failure; 3109 } 3110 3111 nla_nest_end(skb, nest); 3112 return 0; 3113 3114 nla_put_failure: 3115 nlmsg_trim(skb, b); 3116 return -EMSGSIZE; 3117 } 3118 3119 struct nft_set_dump_args { 3120 const struct netlink_callback *cb; 3121 struct nft_set_iter iter; 3122 struct sk_buff *skb; 3123 }; 3124 3125 static int nf_tables_dump_setelem(const struct nft_ctx *ctx, 3126 const struct nft_set *set, 3127 const struct nft_set_iter *iter, 3128 const struct nft_set_elem *elem) 3129 { 3130 struct nft_set_dump_args *args; 3131 3132 args = container_of(iter, struct nft_set_dump_args, iter); 3133 return nf_tables_fill_setelem(args->skb, set, elem); 3134 } 3135 3136 static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb) 3137 { 3138 const struct nft_set *set; 3139 struct nft_set_dump_args args; 3140 struct nft_ctx ctx; 3141 struct nlattr *nla[NFTA_SET_ELEM_LIST_MAX + 1]; 3142 struct nfgenmsg *nfmsg; 3143 struct nlmsghdr *nlh; 3144 struct nlattr *nest; 3145 u32 portid, seq; 3146 int event, err; 3147 3148 err = nlmsg_parse(cb->nlh, sizeof(struct nfgenmsg), nla, 3149 NFTA_SET_ELEM_LIST_MAX, nft_set_elem_list_policy); 3150 if (err < 0) 3151 return err; 3152 3153 err = nft_ctx_init_from_elemattr(&ctx, cb->skb, cb->nlh, (void *)nla, 3154 false); 3155 if (err < 0) 3156 return err; 3157 3158 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET]); 3159 if (IS_ERR(set)) 3160 return PTR_ERR(set); 3161 if (set->flags & NFT_SET_INACTIVE) 3162 return -ENOENT; 3163 3164 event = NFT_MSG_NEWSETELEM; 3165 event |= NFNL_SUBSYS_NFTABLES << 8; 3166 portid = NETLINK_CB(cb->skb).portid; 3167 seq = cb->nlh->nlmsg_seq; 3168 3169 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), 3170 NLM_F_MULTI); 3171 if (nlh == NULL) 3172 goto nla_put_failure; 3173 3174 nfmsg = nlmsg_data(nlh); 3175 nfmsg->nfgen_family = ctx.afi->family; 3176 nfmsg->version = NFNETLINK_V0; 3177 nfmsg->res_id = htons(ctx.net->nft.base_seq & 0xffff); 3178 3179 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, ctx.table->name)) 3180 goto nla_put_failure; 3181 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_SET, set->name)) 3182 goto nla_put_failure; 3183 3184 nest = nla_nest_start(skb, NFTA_SET_ELEM_LIST_ELEMENTS); 3185 if (nest == NULL) 3186 goto nla_put_failure; 3187 3188 args.cb = cb; 3189 args.skb = skb; 3190 args.iter.skip = cb->args[0]; 3191 args.iter.count = 0; 3192 args.iter.err = 0; 3193 args.iter.fn = nf_tables_dump_setelem; 3194 set->ops->walk(&ctx, set, &args.iter); 3195 3196 nla_nest_end(skb, nest); 3197 nlmsg_end(skb, nlh); 3198 3199 if (args.iter.err && args.iter.err != -EMSGSIZE) 3200 return args.iter.err; 3201 if (args.iter.count == cb->args[0]) 3202 return 0; 3203 3204 cb->args[0] = args.iter.count; 3205 return skb->len; 3206 3207 nla_put_failure: 3208 return -ENOSPC; 3209 } 3210 3211 static int nf_tables_getsetelem(struct sock *nlsk, struct sk_buff *skb, 3212 const struct nlmsghdr *nlh, 3213 const struct nlattr * const nla[]) 3214 { 3215 const struct nft_set *set; 3216 struct nft_ctx ctx; 3217 int err; 3218 3219 err = nft_ctx_init_from_elemattr(&ctx, skb, nlh, nla, false); 3220 if (err < 0) 3221 return err; 3222 3223 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET]); 3224 if (IS_ERR(set)) 3225 return PTR_ERR(set); 3226 if (set->flags & NFT_SET_INACTIVE) 3227 return -ENOENT; 3228 3229 if (nlh->nlmsg_flags & NLM_F_DUMP) { 3230 struct netlink_dump_control c = { 3231 .dump = nf_tables_dump_set, 3232 }; 3233 return netlink_dump_start(nlsk, skb, nlh, &c); 3234 } 3235 return -EOPNOTSUPP; 3236 } 3237 3238 static int nf_tables_fill_setelem_info(struct sk_buff *skb, 3239 const struct nft_ctx *ctx, u32 seq, 3240 u32 portid, int event, u16 flags, 3241 const struct nft_set *set, 3242 const struct nft_set_elem *elem) 3243 { 3244 struct nfgenmsg *nfmsg; 3245 struct nlmsghdr *nlh; 3246 struct nlattr *nest; 3247 int err; 3248 3249 event |= NFNL_SUBSYS_NFTABLES << 8; 3250 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), 3251 flags); 3252 if (nlh == NULL) 3253 goto nla_put_failure; 3254 3255 nfmsg = nlmsg_data(nlh); 3256 nfmsg->nfgen_family = ctx->afi->family; 3257 nfmsg->version = NFNETLINK_V0; 3258 nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff); 3259 3260 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name)) 3261 goto nla_put_failure; 3262 if (nla_put_string(skb, NFTA_SET_NAME, set->name)) 3263 goto nla_put_failure; 3264 3265 nest = nla_nest_start(skb, NFTA_SET_ELEM_LIST_ELEMENTS); 3266 if (nest == NULL) 3267 goto nla_put_failure; 3268 3269 err = nf_tables_fill_setelem(skb, set, elem); 3270 if (err < 0) 3271 goto nla_put_failure; 3272 3273 nla_nest_end(skb, nest); 3274 3275 nlmsg_end(skb, nlh); 3276 return 0; 3277 3278 nla_put_failure: 3279 nlmsg_trim(skb, nlh); 3280 return -1; 3281 } 3282 3283 static int nf_tables_setelem_notify(const struct nft_ctx *ctx, 3284 const struct nft_set *set, 3285 const struct nft_set_elem *elem, 3286 int event, u16 flags) 3287 { 3288 struct net *net = ctx->net; 3289 u32 portid = ctx->portid; 3290 struct sk_buff *skb; 3291 int err; 3292 3293 if (!ctx->report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES)) 3294 return 0; 3295 3296 err = -ENOBUFS; 3297 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 3298 if (skb == NULL) 3299 goto err; 3300 3301 err = nf_tables_fill_setelem_info(skb, ctx, 0, portid, event, flags, 3302 set, elem); 3303 if (err < 0) { 3304 kfree_skb(skb); 3305 goto err; 3306 } 3307 3308 err = nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, ctx->report, 3309 GFP_KERNEL); 3310 err: 3311 if (err < 0) 3312 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, err); 3313 return err; 3314 } 3315 3316 static struct nft_trans *nft_trans_elem_alloc(struct nft_ctx *ctx, 3317 int msg_type, 3318 struct nft_set *set) 3319 { 3320 struct nft_trans *trans; 3321 3322 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_elem)); 3323 if (trans == NULL) 3324 return NULL; 3325 3326 nft_trans_elem_set(trans) = set; 3327 return trans; 3328 } 3329 3330 void *nft_set_elem_init(const struct nft_set *set, 3331 const struct nft_set_ext_tmpl *tmpl, 3332 const u32 *key, const u32 *data, 3333 u64 timeout, gfp_t gfp) 3334 { 3335 struct nft_set_ext *ext; 3336 void *elem; 3337 3338 elem = kzalloc(set->ops->elemsize + tmpl->len, gfp); 3339 if (elem == NULL) 3340 return NULL; 3341 3342 ext = nft_set_elem_ext(set, elem); 3343 nft_set_ext_init(ext, tmpl); 3344 3345 memcpy(nft_set_ext_key(ext), key, set->klen); 3346 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA)) 3347 memcpy(nft_set_ext_data(ext), data, set->dlen); 3348 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) 3349 *nft_set_ext_expiration(ext) = 3350 jiffies + msecs_to_jiffies(timeout); 3351 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT)) 3352 *nft_set_ext_timeout(ext) = timeout; 3353 3354 return elem; 3355 } 3356 3357 void nft_set_elem_destroy(const struct nft_set *set, void *elem) 3358 { 3359 struct nft_set_ext *ext = nft_set_elem_ext(set, elem); 3360 3361 nft_data_uninit(nft_set_ext_key(ext), NFT_DATA_VALUE); 3362 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA)) 3363 nft_data_uninit(nft_set_ext_data(ext), set->dtype); 3364 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR)) 3365 nf_tables_expr_destroy(NULL, nft_set_ext_expr(ext)); 3366 3367 kfree(elem); 3368 } 3369 EXPORT_SYMBOL_GPL(nft_set_elem_destroy); 3370 3371 static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, 3372 const struct nlattr *attr) 3373 { 3374 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1]; 3375 struct nft_data_desc d1, d2; 3376 struct nft_set_ext_tmpl tmpl; 3377 struct nft_set_ext *ext; 3378 struct nft_set_elem elem; 3379 struct nft_set_binding *binding; 3380 struct nft_userdata *udata; 3381 struct nft_data data; 3382 enum nft_registers dreg; 3383 struct nft_trans *trans; 3384 u64 timeout; 3385 u32 flags; 3386 u8 ulen; 3387 int err; 3388 3389 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr, 3390 nft_set_elem_policy); 3391 if (err < 0) 3392 return err; 3393 3394 if (nla[NFTA_SET_ELEM_KEY] == NULL) 3395 return -EINVAL; 3396 3397 nft_set_ext_prepare(&tmpl); 3398 3399 flags = 0; 3400 if (nla[NFTA_SET_ELEM_FLAGS] != NULL) { 3401 flags = ntohl(nla_get_be32(nla[NFTA_SET_ELEM_FLAGS])); 3402 if (flags & ~NFT_SET_ELEM_INTERVAL_END) 3403 return -EINVAL; 3404 if (!(set->flags & NFT_SET_INTERVAL) && 3405 flags & NFT_SET_ELEM_INTERVAL_END) 3406 return -EINVAL; 3407 if (flags != 0) 3408 nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS); 3409 } 3410 3411 if (set->flags & NFT_SET_MAP) { 3412 if (nla[NFTA_SET_ELEM_DATA] == NULL && 3413 !(flags & NFT_SET_ELEM_INTERVAL_END)) 3414 return -EINVAL; 3415 if (nla[NFTA_SET_ELEM_DATA] != NULL && 3416 flags & NFT_SET_ELEM_INTERVAL_END) 3417 return -EINVAL; 3418 } else { 3419 if (nla[NFTA_SET_ELEM_DATA] != NULL) 3420 return -EINVAL; 3421 } 3422 3423 timeout = 0; 3424 if (nla[NFTA_SET_ELEM_TIMEOUT] != NULL) { 3425 if (!(set->flags & NFT_SET_TIMEOUT)) 3426 return -EINVAL; 3427 timeout = be64_to_cpu(nla_get_be64(nla[NFTA_SET_ELEM_TIMEOUT])); 3428 } else if (set->flags & NFT_SET_TIMEOUT) { 3429 timeout = set->timeout; 3430 } 3431 3432 err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &d1, 3433 nla[NFTA_SET_ELEM_KEY]); 3434 if (err < 0) 3435 goto err1; 3436 err = -EINVAL; 3437 if (d1.type != NFT_DATA_VALUE || d1.len != set->klen) 3438 goto err2; 3439 3440 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, d1.len); 3441 if (timeout > 0) { 3442 nft_set_ext_add(&tmpl, NFT_SET_EXT_EXPIRATION); 3443 if (timeout != set->timeout) 3444 nft_set_ext_add(&tmpl, NFT_SET_EXT_TIMEOUT); 3445 } 3446 3447 if (nla[NFTA_SET_ELEM_DATA] != NULL) { 3448 err = nft_data_init(ctx, &data, sizeof(data), &d2, 3449 nla[NFTA_SET_ELEM_DATA]); 3450 if (err < 0) 3451 goto err2; 3452 3453 err = -EINVAL; 3454 if (set->dtype != NFT_DATA_VERDICT && d2.len != set->dlen) 3455 goto err3; 3456 3457 dreg = nft_type_to_reg(set->dtype); 3458 list_for_each_entry(binding, &set->bindings, list) { 3459 struct nft_ctx bind_ctx = { 3460 .afi = ctx->afi, 3461 .table = ctx->table, 3462 .chain = (struct nft_chain *)binding->chain, 3463 }; 3464 3465 if (!(binding->flags & NFT_SET_MAP)) 3466 continue; 3467 3468 err = nft_validate_register_store(&bind_ctx, dreg, 3469 &data, 3470 d2.type, d2.len); 3471 if (err < 0) 3472 goto err3; 3473 } 3474 3475 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_DATA, d2.len); 3476 } 3477 3478 /* The full maximum length of userdata can exceed the maximum 3479 * offset value (U8_MAX) for following extensions, therefor it 3480 * must be the last extension added. 3481 */ 3482 ulen = 0; 3483 if (nla[NFTA_SET_ELEM_USERDATA] != NULL) { 3484 ulen = nla_len(nla[NFTA_SET_ELEM_USERDATA]); 3485 if (ulen > 0) 3486 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_USERDATA, 3487 ulen); 3488 } 3489 3490 err = -ENOMEM; 3491 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, data.data, 3492 timeout, GFP_KERNEL); 3493 if (elem.priv == NULL) 3494 goto err3; 3495 3496 ext = nft_set_elem_ext(set, elem.priv); 3497 if (flags) 3498 *nft_set_ext_flags(ext) = flags; 3499 if (ulen > 0) { 3500 udata = nft_set_ext_userdata(ext); 3501 udata->len = ulen - 1; 3502 nla_memcpy(&udata->data, nla[NFTA_SET_ELEM_USERDATA], ulen); 3503 } 3504 3505 trans = nft_trans_elem_alloc(ctx, NFT_MSG_NEWSETELEM, set); 3506 if (trans == NULL) 3507 goto err4; 3508 3509 ext->genmask = nft_genmask_cur(ctx->net) | NFT_SET_ELEM_BUSY_MASK; 3510 err = set->ops->insert(set, &elem); 3511 if (err < 0) 3512 goto err5; 3513 3514 nft_trans_elem(trans) = elem; 3515 list_add_tail(&trans->list, &ctx->net->nft.commit_list); 3516 return 0; 3517 3518 err5: 3519 kfree(trans); 3520 err4: 3521 kfree(elem.priv); 3522 err3: 3523 if (nla[NFTA_SET_ELEM_DATA] != NULL) 3524 nft_data_uninit(&data, d2.type); 3525 err2: 3526 nft_data_uninit(&elem.key.val, d1.type); 3527 err1: 3528 return err; 3529 } 3530 3531 static int nf_tables_newsetelem(struct sock *nlsk, struct sk_buff *skb, 3532 const struct nlmsghdr *nlh, 3533 const struct nlattr * const nla[]) 3534 { 3535 struct net *net = sock_net(skb->sk); 3536 const struct nlattr *attr; 3537 struct nft_set *set; 3538 struct nft_ctx ctx; 3539 int rem, err = 0; 3540 3541 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL) 3542 return -EINVAL; 3543 3544 err = nft_ctx_init_from_elemattr(&ctx, skb, nlh, nla, true); 3545 if (err < 0) 3546 return err; 3547 3548 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET]); 3549 if (IS_ERR(set)) { 3550 if (nla[NFTA_SET_ELEM_LIST_SET_ID]) { 3551 set = nf_tables_set_lookup_byid(net, 3552 nla[NFTA_SET_ELEM_LIST_SET_ID]); 3553 } 3554 if (IS_ERR(set)) 3555 return PTR_ERR(set); 3556 } 3557 3558 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT) 3559 return -EBUSY; 3560 3561 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) { 3562 if (set->size && 3563 !atomic_add_unless(&set->nelems, 1, set->size + set->ndeact)) 3564 return -ENFILE; 3565 3566 err = nft_add_set_elem(&ctx, set, attr); 3567 if (err < 0) { 3568 atomic_dec(&set->nelems); 3569 break; 3570 } 3571 } 3572 return err; 3573 } 3574 3575 static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set, 3576 const struct nlattr *attr) 3577 { 3578 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1]; 3579 struct nft_data_desc desc; 3580 struct nft_set_elem elem; 3581 struct nft_trans *trans; 3582 int err; 3583 3584 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr, 3585 nft_set_elem_policy); 3586 if (err < 0) 3587 goto err1; 3588 3589 err = -EINVAL; 3590 if (nla[NFTA_SET_ELEM_KEY] == NULL) 3591 goto err1; 3592 3593 err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &desc, 3594 nla[NFTA_SET_ELEM_KEY]); 3595 if (err < 0) 3596 goto err1; 3597 3598 err = -EINVAL; 3599 if (desc.type != NFT_DATA_VALUE || desc.len != set->klen) 3600 goto err2; 3601 3602 trans = nft_trans_elem_alloc(ctx, NFT_MSG_DELSETELEM, set); 3603 if (trans == NULL) { 3604 err = -ENOMEM; 3605 goto err2; 3606 } 3607 3608 elem.priv = set->ops->deactivate(set, &elem); 3609 if (elem.priv == NULL) { 3610 err = -ENOENT; 3611 goto err3; 3612 } 3613 3614 nft_trans_elem(trans) = elem; 3615 list_add_tail(&trans->list, &ctx->net->nft.commit_list); 3616 return 0; 3617 3618 err3: 3619 kfree(trans); 3620 err2: 3621 nft_data_uninit(&elem.key.val, desc.type); 3622 err1: 3623 return err; 3624 } 3625 3626 static int nf_tables_delsetelem(struct sock *nlsk, struct sk_buff *skb, 3627 const struct nlmsghdr *nlh, 3628 const struct nlattr * const nla[]) 3629 { 3630 const struct nlattr *attr; 3631 struct nft_set *set; 3632 struct nft_ctx ctx; 3633 int rem, err = 0; 3634 3635 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL) 3636 return -EINVAL; 3637 3638 err = nft_ctx_init_from_elemattr(&ctx, skb, nlh, nla, false); 3639 if (err < 0) 3640 return err; 3641 3642 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET]); 3643 if (IS_ERR(set)) 3644 return PTR_ERR(set); 3645 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT) 3646 return -EBUSY; 3647 3648 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) { 3649 err = nft_del_setelem(&ctx, set, attr); 3650 if (err < 0) 3651 break; 3652 3653 set->ndeact++; 3654 } 3655 return err; 3656 } 3657 3658 void nft_set_gc_batch_release(struct rcu_head *rcu) 3659 { 3660 struct nft_set_gc_batch *gcb; 3661 unsigned int i; 3662 3663 gcb = container_of(rcu, struct nft_set_gc_batch, head.rcu); 3664 for (i = 0; i < gcb->head.cnt; i++) 3665 nft_set_elem_destroy(gcb->head.set, gcb->elems[i]); 3666 kfree(gcb); 3667 } 3668 EXPORT_SYMBOL_GPL(nft_set_gc_batch_release); 3669 3670 struct nft_set_gc_batch *nft_set_gc_batch_alloc(const struct nft_set *set, 3671 gfp_t gfp) 3672 { 3673 struct nft_set_gc_batch *gcb; 3674 3675 gcb = kzalloc(sizeof(*gcb), gfp); 3676 if (gcb == NULL) 3677 return gcb; 3678 gcb->head.set = set; 3679 return gcb; 3680 } 3681 EXPORT_SYMBOL_GPL(nft_set_gc_batch_alloc); 3682 3683 static int nf_tables_fill_gen_info(struct sk_buff *skb, struct net *net, 3684 u32 portid, u32 seq) 3685 { 3686 struct nlmsghdr *nlh; 3687 struct nfgenmsg *nfmsg; 3688 int event = (NFNL_SUBSYS_NFTABLES << 8) | NFT_MSG_NEWGEN; 3689 3690 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), 0); 3691 if (nlh == NULL) 3692 goto nla_put_failure; 3693 3694 nfmsg = nlmsg_data(nlh); 3695 nfmsg->nfgen_family = AF_UNSPEC; 3696 nfmsg->version = NFNETLINK_V0; 3697 nfmsg->res_id = htons(net->nft.base_seq & 0xffff); 3698 3699 if (nla_put_be32(skb, NFTA_GEN_ID, htonl(net->nft.base_seq))) 3700 goto nla_put_failure; 3701 3702 nlmsg_end(skb, nlh); 3703 return 0; 3704 3705 nla_put_failure: 3706 nlmsg_trim(skb, nlh); 3707 return -EMSGSIZE; 3708 } 3709 3710 static int nf_tables_gen_notify(struct net *net, struct sk_buff *skb, int event) 3711 { 3712 struct nlmsghdr *nlh = nlmsg_hdr(skb); 3713 struct sk_buff *skb2; 3714 int err; 3715 3716 if (nlmsg_report(nlh) && 3717 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES)) 3718 return 0; 3719 3720 err = -ENOBUFS; 3721 skb2 = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 3722 if (skb2 == NULL) 3723 goto err; 3724 3725 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid, 3726 nlh->nlmsg_seq); 3727 if (err < 0) { 3728 kfree_skb(skb2); 3729 goto err; 3730 } 3731 3732 err = nfnetlink_send(skb2, net, NETLINK_CB(skb).portid, 3733 NFNLGRP_NFTABLES, nlmsg_report(nlh), GFP_KERNEL); 3734 err: 3735 if (err < 0) { 3736 nfnetlink_set_err(net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES, 3737 err); 3738 } 3739 return err; 3740 } 3741 3742 static int nf_tables_getgen(struct sock *nlsk, struct sk_buff *skb, 3743 const struct nlmsghdr *nlh, 3744 const struct nlattr * const nla[]) 3745 { 3746 struct net *net = sock_net(skb->sk); 3747 struct sk_buff *skb2; 3748 int err; 3749 3750 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL); 3751 if (skb2 == NULL) 3752 return -ENOMEM; 3753 3754 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid, 3755 nlh->nlmsg_seq); 3756 if (err < 0) 3757 goto err; 3758 3759 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid); 3760 err: 3761 kfree_skb(skb2); 3762 return err; 3763 } 3764 3765 static const struct nfnl_callback nf_tables_cb[NFT_MSG_MAX] = { 3766 [NFT_MSG_NEWTABLE] = { 3767 .call_batch = nf_tables_newtable, 3768 .attr_count = NFTA_TABLE_MAX, 3769 .policy = nft_table_policy, 3770 }, 3771 [NFT_MSG_GETTABLE] = { 3772 .call = nf_tables_gettable, 3773 .attr_count = NFTA_TABLE_MAX, 3774 .policy = nft_table_policy, 3775 }, 3776 [NFT_MSG_DELTABLE] = { 3777 .call_batch = nf_tables_deltable, 3778 .attr_count = NFTA_TABLE_MAX, 3779 .policy = nft_table_policy, 3780 }, 3781 [NFT_MSG_NEWCHAIN] = { 3782 .call_batch = nf_tables_newchain, 3783 .attr_count = NFTA_CHAIN_MAX, 3784 .policy = nft_chain_policy, 3785 }, 3786 [NFT_MSG_GETCHAIN] = { 3787 .call = nf_tables_getchain, 3788 .attr_count = NFTA_CHAIN_MAX, 3789 .policy = nft_chain_policy, 3790 }, 3791 [NFT_MSG_DELCHAIN] = { 3792 .call_batch = nf_tables_delchain, 3793 .attr_count = NFTA_CHAIN_MAX, 3794 .policy = nft_chain_policy, 3795 }, 3796 [NFT_MSG_NEWRULE] = { 3797 .call_batch = nf_tables_newrule, 3798 .attr_count = NFTA_RULE_MAX, 3799 .policy = nft_rule_policy, 3800 }, 3801 [NFT_MSG_GETRULE] = { 3802 .call = nf_tables_getrule, 3803 .attr_count = NFTA_RULE_MAX, 3804 .policy = nft_rule_policy, 3805 }, 3806 [NFT_MSG_DELRULE] = { 3807 .call_batch = nf_tables_delrule, 3808 .attr_count = NFTA_RULE_MAX, 3809 .policy = nft_rule_policy, 3810 }, 3811 [NFT_MSG_NEWSET] = { 3812 .call_batch = nf_tables_newset, 3813 .attr_count = NFTA_SET_MAX, 3814 .policy = nft_set_policy, 3815 }, 3816 [NFT_MSG_GETSET] = { 3817 .call = nf_tables_getset, 3818 .attr_count = NFTA_SET_MAX, 3819 .policy = nft_set_policy, 3820 }, 3821 [NFT_MSG_DELSET] = { 3822 .call_batch = nf_tables_delset, 3823 .attr_count = NFTA_SET_MAX, 3824 .policy = nft_set_policy, 3825 }, 3826 [NFT_MSG_NEWSETELEM] = { 3827 .call_batch = nf_tables_newsetelem, 3828 .attr_count = NFTA_SET_ELEM_LIST_MAX, 3829 .policy = nft_set_elem_list_policy, 3830 }, 3831 [NFT_MSG_GETSETELEM] = { 3832 .call = nf_tables_getsetelem, 3833 .attr_count = NFTA_SET_ELEM_LIST_MAX, 3834 .policy = nft_set_elem_list_policy, 3835 }, 3836 [NFT_MSG_DELSETELEM] = { 3837 .call_batch = nf_tables_delsetelem, 3838 .attr_count = NFTA_SET_ELEM_LIST_MAX, 3839 .policy = nft_set_elem_list_policy, 3840 }, 3841 [NFT_MSG_GETGEN] = { 3842 .call = nf_tables_getgen, 3843 }, 3844 }; 3845 3846 static void nft_chain_commit_update(struct nft_trans *trans) 3847 { 3848 struct nft_base_chain *basechain; 3849 3850 if (nft_trans_chain_name(trans)[0]) 3851 strcpy(trans->ctx.chain->name, nft_trans_chain_name(trans)); 3852 3853 if (!(trans->ctx.chain->flags & NFT_BASE_CHAIN)) 3854 return; 3855 3856 basechain = nft_base_chain(trans->ctx.chain); 3857 nft_chain_stats_replace(basechain, nft_trans_chain_stats(trans)); 3858 3859 switch (nft_trans_chain_policy(trans)) { 3860 case NF_DROP: 3861 case NF_ACCEPT: 3862 basechain->policy = nft_trans_chain_policy(trans); 3863 break; 3864 } 3865 } 3866 3867 static void nf_tables_commit_release(struct nft_trans *trans) 3868 { 3869 switch (trans->msg_type) { 3870 case NFT_MSG_DELTABLE: 3871 nf_tables_table_destroy(&trans->ctx); 3872 break; 3873 case NFT_MSG_DELCHAIN: 3874 nf_tables_chain_destroy(trans->ctx.chain); 3875 break; 3876 case NFT_MSG_DELRULE: 3877 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans)); 3878 break; 3879 case NFT_MSG_DELSET: 3880 nft_set_destroy(nft_trans_set(trans)); 3881 break; 3882 case NFT_MSG_DELSETELEM: 3883 nft_set_elem_destroy(nft_trans_elem_set(trans), 3884 nft_trans_elem(trans).priv); 3885 break; 3886 } 3887 kfree(trans); 3888 } 3889 3890 static int nf_tables_commit(struct sk_buff *skb) 3891 { 3892 struct net *net = sock_net(skb->sk); 3893 struct nft_trans *trans, *next; 3894 struct nft_trans_elem *te; 3895 3896 /* Bump generation counter, invalidate any dump in progress */ 3897 while (++net->nft.base_seq == 0); 3898 3899 /* A new generation has just started */ 3900 net->nft.gencursor = nft_gencursor_next(net); 3901 3902 /* Make sure all packets have left the previous generation before 3903 * purging old rules. 3904 */ 3905 synchronize_rcu(); 3906 3907 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) { 3908 switch (trans->msg_type) { 3909 case NFT_MSG_NEWTABLE: 3910 if (nft_trans_table_update(trans)) { 3911 if (!nft_trans_table_enable(trans)) { 3912 nf_tables_table_disable(trans->ctx.afi, 3913 trans->ctx.table); 3914 trans->ctx.table->flags |= NFT_TABLE_F_DORMANT; 3915 } 3916 } else { 3917 trans->ctx.table->flags &= ~NFT_TABLE_INACTIVE; 3918 } 3919 nf_tables_table_notify(&trans->ctx, NFT_MSG_NEWTABLE); 3920 nft_trans_destroy(trans); 3921 break; 3922 case NFT_MSG_DELTABLE: 3923 nf_tables_table_notify(&trans->ctx, NFT_MSG_DELTABLE); 3924 break; 3925 case NFT_MSG_NEWCHAIN: 3926 if (nft_trans_chain_update(trans)) 3927 nft_chain_commit_update(trans); 3928 else 3929 trans->ctx.chain->flags &= ~NFT_CHAIN_INACTIVE; 3930 3931 nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN); 3932 nft_trans_destroy(trans); 3933 break; 3934 case NFT_MSG_DELCHAIN: 3935 nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN); 3936 nf_tables_unregister_hooks(trans->ctx.table, 3937 trans->ctx.chain, 3938 trans->ctx.afi->nops); 3939 break; 3940 case NFT_MSG_NEWRULE: 3941 nft_rule_clear(trans->ctx.net, nft_trans_rule(trans)); 3942 nf_tables_rule_notify(&trans->ctx, 3943 nft_trans_rule(trans), 3944 NFT_MSG_NEWRULE); 3945 nft_trans_destroy(trans); 3946 break; 3947 case NFT_MSG_DELRULE: 3948 list_del_rcu(&nft_trans_rule(trans)->list); 3949 nf_tables_rule_notify(&trans->ctx, 3950 nft_trans_rule(trans), 3951 NFT_MSG_DELRULE); 3952 break; 3953 case NFT_MSG_NEWSET: 3954 nft_trans_set(trans)->flags &= ~NFT_SET_INACTIVE; 3955 /* This avoids hitting -EBUSY when deleting the table 3956 * from the transaction. 3957 */ 3958 if (nft_trans_set(trans)->flags & NFT_SET_ANONYMOUS && 3959 !list_empty(&nft_trans_set(trans)->bindings)) 3960 trans->ctx.table->use--; 3961 3962 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans), 3963 NFT_MSG_NEWSET, GFP_KERNEL); 3964 nft_trans_destroy(trans); 3965 break; 3966 case NFT_MSG_DELSET: 3967 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans), 3968 NFT_MSG_DELSET, GFP_KERNEL); 3969 break; 3970 case NFT_MSG_NEWSETELEM: 3971 te = (struct nft_trans_elem *)trans->data; 3972 3973 te->set->ops->activate(te->set, &te->elem); 3974 nf_tables_setelem_notify(&trans->ctx, te->set, 3975 &te->elem, 3976 NFT_MSG_NEWSETELEM, 0); 3977 nft_trans_destroy(trans); 3978 break; 3979 case NFT_MSG_DELSETELEM: 3980 te = (struct nft_trans_elem *)trans->data; 3981 3982 nf_tables_setelem_notify(&trans->ctx, te->set, 3983 &te->elem, 3984 NFT_MSG_DELSETELEM, 0); 3985 te->set->ops->remove(te->set, &te->elem); 3986 atomic_dec(&te->set->nelems); 3987 te->set->ndeact--; 3988 break; 3989 } 3990 } 3991 3992 synchronize_rcu(); 3993 3994 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) { 3995 list_del(&trans->list); 3996 nf_tables_commit_release(trans); 3997 } 3998 3999 nf_tables_gen_notify(net, skb, NFT_MSG_NEWGEN); 4000 4001 return 0; 4002 } 4003 4004 static void nf_tables_abort_release(struct nft_trans *trans) 4005 { 4006 switch (trans->msg_type) { 4007 case NFT_MSG_NEWTABLE: 4008 nf_tables_table_destroy(&trans->ctx); 4009 break; 4010 case NFT_MSG_NEWCHAIN: 4011 nf_tables_chain_destroy(trans->ctx.chain); 4012 break; 4013 case NFT_MSG_NEWRULE: 4014 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans)); 4015 break; 4016 case NFT_MSG_NEWSET: 4017 nft_set_destroy(nft_trans_set(trans)); 4018 break; 4019 case NFT_MSG_NEWSETELEM: 4020 nft_set_elem_destroy(nft_trans_elem_set(trans), 4021 nft_trans_elem(trans).priv); 4022 break; 4023 } 4024 kfree(trans); 4025 } 4026 4027 static int nf_tables_abort(struct sk_buff *skb) 4028 { 4029 struct net *net = sock_net(skb->sk); 4030 struct nft_trans *trans, *next; 4031 struct nft_trans_elem *te; 4032 4033 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) { 4034 switch (trans->msg_type) { 4035 case NFT_MSG_NEWTABLE: 4036 if (nft_trans_table_update(trans)) { 4037 if (nft_trans_table_enable(trans)) { 4038 nf_tables_table_disable(trans->ctx.afi, 4039 trans->ctx.table); 4040 trans->ctx.table->flags |= NFT_TABLE_F_DORMANT; 4041 } 4042 nft_trans_destroy(trans); 4043 } else { 4044 list_del_rcu(&trans->ctx.table->list); 4045 } 4046 break; 4047 case NFT_MSG_DELTABLE: 4048 list_add_tail_rcu(&trans->ctx.table->list, 4049 &trans->ctx.afi->tables); 4050 nft_trans_destroy(trans); 4051 break; 4052 case NFT_MSG_NEWCHAIN: 4053 if (nft_trans_chain_update(trans)) { 4054 free_percpu(nft_trans_chain_stats(trans)); 4055 4056 nft_trans_destroy(trans); 4057 } else { 4058 trans->ctx.table->use--; 4059 list_del_rcu(&trans->ctx.chain->list); 4060 nf_tables_unregister_hooks(trans->ctx.table, 4061 trans->ctx.chain, 4062 trans->ctx.afi->nops); 4063 } 4064 break; 4065 case NFT_MSG_DELCHAIN: 4066 trans->ctx.table->use++; 4067 list_add_tail_rcu(&trans->ctx.chain->list, 4068 &trans->ctx.table->chains); 4069 nft_trans_destroy(trans); 4070 break; 4071 case NFT_MSG_NEWRULE: 4072 trans->ctx.chain->use--; 4073 list_del_rcu(&nft_trans_rule(trans)->list); 4074 break; 4075 case NFT_MSG_DELRULE: 4076 trans->ctx.chain->use++; 4077 nft_rule_clear(trans->ctx.net, nft_trans_rule(trans)); 4078 nft_trans_destroy(trans); 4079 break; 4080 case NFT_MSG_NEWSET: 4081 trans->ctx.table->use--; 4082 list_del_rcu(&nft_trans_set(trans)->list); 4083 break; 4084 case NFT_MSG_DELSET: 4085 trans->ctx.table->use++; 4086 list_add_tail_rcu(&nft_trans_set(trans)->list, 4087 &trans->ctx.table->sets); 4088 nft_trans_destroy(trans); 4089 break; 4090 case NFT_MSG_NEWSETELEM: 4091 te = (struct nft_trans_elem *)trans->data; 4092 4093 te->set->ops->remove(te->set, &te->elem); 4094 atomic_dec(&te->set->nelems); 4095 break; 4096 case NFT_MSG_DELSETELEM: 4097 te = (struct nft_trans_elem *)trans->data; 4098 4099 te->set->ops->activate(te->set, &te->elem); 4100 te->set->ndeact--; 4101 4102 nft_trans_destroy(trans); 4103 break; 4104 } 4105 } 4106 4107 synchronize_rcu(); 4108 4109 list_for_each_entry_safe_reverse(trans, next, 4110 &net->nft.commit_list, list) { 4111 list_del(&trans->list); 4112 nf_tables_abort_release(trans); 4113 } 4114 4115 return 0; 4116 } 4117 4118 static const struct nfnetlink_subsystem nf_tables_subsys = { 4119 .name = "nf_tables", 4120 .subsys_id = NFNL_SUBSYS_NFTABLES, 4121 .cb_count = NFT_MSG_MAX, 4122 .cb = nf_tables_cb, 4123 .commit = nf_tables_commit, 4124 .abort = nf_tables_abort, 4125 }; 4126 4127 int nft_chain_validate_dependency(const struct nft_chain *chain, 4128 enum nft_chain_type type) 4129 { 4130 const struct nft_base_chain *basechain; 4131 4132 if (chain->flags & NFT_BASE_CHAIN) { 4133 basechain = nft_base_chain(chain); 4134 if (basechain->type->type != type) 4135 return -EOPNOTSUPP; 4136 } 4137 return 0; 4138 } 4139 EXPORT_SYMBOL_GPL(nft_chain_validate_dependency); 4140 4141 int nft_chain_validate_hooks(const struct nft_chain *chain, 4142 unsigned int hook_flags) 4143 { 4144 struct nft_base_chain *basechain; 4145 4146 if (chain->flags & NFT_BASE_CHAIN) { 4147 basechain = nft_base_chain(chain); 4148 4149 if ((1 << basechain->ops[0].hooknum) & hook_flags) 4150 return 0; 4151 4152 return -EOPNOTSUPP; 4153 } 4154 4155 return 0; 4156 } 4157 EXPORT_SYMBOL_GPL(nft_chain_validate_hooks); 4158 4159 /* 4160 * Loop detection - walk through the ruleset beginning at the destination chain 4161 * of a new jump until either the source chain is reached (loop) or all 4162 * reachable chains have been traversed. 4163 * 4164 * The loop check is performed whenever a new jump verdict is added to an 4165 * expression or verdict map or a verdict map is bound to a new chain. 4166 */ 4167 4168 static int nf_tables_check_loops(const struct nft_ctx *ctx, 4169 const struct nft_chain *chain); 4170 4171 static int nf_tables_loop_check_setelem(const struct nft_ctx *ctx, 4172 const struct nft_set *set, 4173 const struct nft_set_iter *iter, 4174 const struct nft_set_elem *elem) 4175 { 4176 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); 4177 const struct nft_data *data; 4178 4179 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) && 4180 *nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END) 4181 return 0; 4182 4183 data = nft_set_ext_data(ext); 4184 switch (data->verdict.code) { 4185 case NFT_JUMP: 4186 case NFT_GOTO: 4187 return nf_tables_check_loops(ctx, data->verdict.chain); 4188 default: 4189 return 0; 4190 } 4191 } 4192 4193 static int nf_tables_check_loops(const struct nft_ctx *ctx, 4194 const struct nft_chain *chain) 4195 { 4196 const struct nft_rule *rule; 4197 const struct nft_expr *expr, *last; 4198 const struct nft_set *set; 4199 struct nft_set_binding *binding; 4200 struct nft_set_iter iter; 4201 4202 if (ctx->chain == chain) 4203 return -ELOOP; 4204 4205 list_for_each_entry(rule, &chain->rules, list) { 4206 nft_rule_for_each_expr(expr, last, rule) { 4207 const struct nft_data *data = NULL; 4208 int err; 4209 4210 if (!expr->ops->validate) 4211 continue; 4212 4213 err = expr->ops->validate(ctx, expr, &data); 4214 if (err < 0) 4215 return err; 4216 4217 if (data == NULL) 4218 continue; 4219 4220 switch (data->verdict.code) { 4221 case NFT_JUMP: 4222 case NFT_GOTO: 4223 err = nf_tables_check_loops(ctx, 4224 data->verdict.chain); 4225 if (err < 0) 4226 return err; 4227 default: 4228 break; 4229 } 4230 } 4231 } 4232 4233 list_for_each_entry(set, &ctx->table->sets, list) { 4234 if (!(set->flags & NFT_SET_MAP) || 4235 set->dtype != NFT_DATA_VERDICT) 4236 continue; 4237 4238 list_for_each_entry(binding, &set->bindings, list) { 4239 if (!(binding->flags & NFT_SET_MAP) || 4240 binding->chain != chain) 4241 continue; 4242 4243 iter.skip = 0; 4244 iter.count = 0; 4245 iter.err = 0; 4246 iter.fn = nf_tables_loop_check_setelem; 4247 4248 set->ops->walk(ctx, set, &iter); 4249 if (iter.err < 0) 4250 return iter.err; 4251 } 4252 } 4253 4254 return 0; 4255 } 4256 4257 /** 4258 * nft_parse_register - parse a register value from a netlink attribute 4259 * 4260 * @attr: netlink attribute 4261 * 4262 * Parse and translate a register value from a netlink attribute. 4263 * Registers used to be 128 bit wide, these register numbers will be 4264 * mapped to the corresponding 32 bit register numbers. 4265 */ 4266 unsigned int nft_parse_register(const struct nlattr *attr) 4267 { 4268 unsigned int reg; 4269 4270 reg = ntohl(nla_get_be32(attr)); 4271 switch (reg) { 4272 case NFT_REG_VERDICT...NFT_REG_4: 4273 return reg * NFT_REG_SIZE / NFT_REG32_SIZE; 4274 default: 4275 return reg + NFT_REG_SIZE / NFT_REG32_SIZE - NFT_REG32_00; 4276 } 4277 } 4278 EXPORT_SYMBOL_GPL(nft_parse_register); 4279 4280 /** 4281 * nft_dump_register - dump a register value to a netlink attribute 4282 * 4283 * @skb: socket buffer 4284 * @attr: attribute number 4285 * @reg: register number 4286 * 4287 * Construct a netlink attribute containing the register number. For 4288 * compatibility reasons, register numbers being a multiple of 4 are 4289 * translated to the corresponding 128 bit register numbers. 4290 */ 4291 int nft_dump_register(struct sk_buff *skb, unsigned int attr, unsigned int reg) 4292 { 4293 if (reg % (NFT_REG_SIZE / NFT_REG32_SIZE) == 0) 4294 reg = reg / (NFT_REG_SIZE / NFT_REG32_SIZE); 4295 else 4296 reg = reg - NFT_REG_SIZE / NFT_REG32_SIZE + NFT_REG32_00; 4297 4298 return nla_put_be32(skb, attr, htonl(reg)); 4299 } 4300 EXPORT_SYMBOL_GPL(nft_dump_register); 4301 4302 /** 4303 * nft_validate_register_load - validate a load from a register 4304 * 4305 * @reg: the register number 4306 * @len: the length of the data 4307 * 4308 * Validate that the input register is one of the general purpose 4309 * registers and that the length of the load is within the bounds. 4310 */ 4311 int nft_validate_register_load(enum nft_registers reg, unsigned int len) 4312 { 4313 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE) 4314 return -EINVAL; 4315 if (len == 0) 4316 return -EINVAL; 4317 if (reg * NFT_REG32_SIZE + len > FIELD_SIZEOF(struct nft_regs, data)) 4318 return -ERANGE; 4319 4320 return 0; 4321 } 4322 EXPORT_SYMBOL_GPL(nft_validate_register_load); 4323 4324 /** 4325 * nft_validate_register_store - validate an expressions' register store 4326 * 4327 * @ctx: context of the expression performing the load 4328 * @reg: the destination register number 4329 * @data: the data to load 4330 * @type: the data type 4331 * @len: the length of the data 4332 * 4333 * Validate that a data load uses the appropriate data type for 4334 * the destination register and the length is within the bounds. 4335 * A value of NULL for the data means that its runtime gathered 4336 * data. 4337 */ 4338 int nft_validate_register_store(const struct nft_ctx *ctx, 4339 enum nft_registers reg, 4340 const struct nft_data *data, 4341 enum nft_data_types type, unsigned int len) 4342 { 4343 int err; 4344 4345 switch (reg) { 4346 case NFT_REG_VERDICT: 4347 if (type != NFT_DATA_VERDICT) 4348 return -EINVAL; 4349 4350 if (data != NULL && 4351 (data->verdict.code == NFT_GOTO || 4352 data->verdict.code == NFT_JUMP)) { 4353 err = nf_tables_check_loops(ctx, data->verdict.chain); 4354 if (err < 0) 4355 return err; 4356 4357 if (ctx->chain->level + 1 > 4358 data->verdict.chain->level) { 4359 if (ctx->chain->level + 1 == NFT_JUMP_STACK_SIZE) 4360 return -EMLINK; 4361 data->verdict.chain->level = ctx->chain->level + 1; 4362 } 4363 } 4364 4365 return 0; 4366 default: 4367 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE) 4368 return -EINVAL; 4369 if (len == 0) 4370 return -EINVAL; 4371 if (reg * NFT_REG32_SIZE + len > 4372 FIELD_SIZEOF(struct nft_regs, data)) 4373 return -ERANGE; 4374 4375 if (data != NULL && type != NFT_DATA_VALUE) 4376 return -EINVAL; 4377 return 0; 4378 } 4379 } 4380 EXPORT_SYMBOL_GPL(nft_validate_register_store); 4381 4382 static const struct nla_policy nft_verdict_policy[NFTA_VERDICT_MAX + 1] = { 4383 [NFTA_VERDICT_CODE] = { .type = NLA_U32 }, 4384 [NFTA_VERDICT_CHAIN] = { .type = NLA_STRING, 4385 .len = NFT_CHAIN_MAXNAMELEN - 1 }, 4386 }; 4387 4388 static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data, 4389 struct nft_data_desc *desc, const struct nlattr *nla) 4390 { 4391 struct nlattr *tb[NFTA_VERDICT_MAX + 1]; 4392 struct nft_chain *chain; 4393 int err; 4394 4395 err = nla_parse_nested(tb, NFTA_VERDICT_MAX, nla, nft_verdict_policy); 4396 if (err < 0) 4397 return err; 4398 4399 if (!tb[NFTA_VERDICT_CODE]) 4400 return -EINVAL; 4401 data->verdict.code = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE])); 4402 4403 switch (data->verdict.code) { 4404 default: 4405 switch (data->verdict.code & NF_VERDICT_MASK) { 4406 case NF_ACCEPT: 4407 case NF_DROP: 4408 case NF_QUEUE: 4409 break; 4410 default: 4411 return -EINVAL; 4412 } 4413 /* fall through */ 4414 case NFT_CONTINUE: 4415 case NFT_BREAK: 4416 case NFT_RETURN: 4417 break; 4418 case NFT_JUMP: 4419 case NFT_GOTO: 4420 if (!tb[NFTA_VERDICT_CHAIN]) 4421 return -EINVAL; 4422 chain = nf_tables_chain_lookup(ctx->table, 4423 tb[NFTA_VERDICT_CHAIN]); 4424 if (IS_ERR(chain)) 4425 return PTR_ERR(chain); 4426 if (chain->flags & NFT_BASE_CHAIN) 4427 return -EOPNOTSUPP; 4428 4429 chain->use++; 4430 data->verdict.chain = chain; 4431 break; 4432 } 4433 4434 desc->len = sizeof(data->verdict); 4435 desc->type = NFT_DATA_VERDICT; 4436 return 0; 4437 } 4438 4439 static void nft_verdict_uninit(const struct nft_data *data) 4440 { 4441 switch (data->verdict.code) { 4442 case NFT_JUMP: 4443 case NFT_GOTO: 4444 data->verdict.chain->use--; 4445 break; 4446 } 4447 } 4448 4449 static int nft_verdict_dump(struct sk_buff *skb, const struct nft_data *data) 4450 { 4451 struct nlattr *nest; 4452 4453 nest = nla_nest_start(skb, NFTA_DATA_VERDICT); 4454 if (!nest) 4455 goto nla_put_failure; 4456 4457 if (nla_put_be32(skb, NFTA_VERDICT_CODE, htonl(data->verdict.code))) 4458 goto nla_put_failure; 4459 4460 switch (data->verdict.code) { 4461 case NFT_JUMP: 4462 case NFT_GOTO: 4463 if (nla_put_string(skb, NFTA_VERDICT_CHAIN, 4464 data->verdict.chain->name)) 4465 goto nla_put_failure; 4466 } 4467 nla_nest_end(skb, nest); 4468 return 0; 4469 4470 nla_put_failure: 4471 return -1; 4472 } 4473 4474 static int nft_value_init(const struct nft_ctx *ctx, 4475 struct nft_data *data, unsigned int size, 4476 struct nft_data_desc *desc, const struct nlattr *nla) 4477 { 4478 unsigned int len; 4479 4480 len = nla_len(nla); 4481 if (len == 0) 4482 return -EINVAL; 4483 if (len > size) 4484 return -EOVERFLOW; 4485 4486 nla_memcpy(data->data, nla, len); 4487 desc->type = NFT_DATA_VALUE; 4488 desc->len = len; 4489 return 0; 4490 } 4491 4492 static int nft_value_dump(struct sk_buff *skb, const struct nft_data *data, 4493 unsigned int len) 4494 { 4495 return nla_put(skb, NFTA_DATA_VALUE, len, data->data); 4496 } 4497 4498 static const struct nla_policy nft_data_policy[NFTA_DATA_MAX + 1] = { 4499 [NFTA_DATA_VALUE] = { .type = NLA_BINARY }, 4500 [NFTA_DATA_VERDICT] = { .type = NLA_NESTED }, 4501 }; 4502 4503 /** 4504 * nft_data_init - parse nf_tables data netlink attributes 4505 * 4506 * @ctx: context of the expression using the data 4507 * @data: destination struct nft_data 4508 * @size: maximum data length 4509 * @desc: data description 4510 * @nla: netlink attribute containing data 4511 * 4512 * Parse the netlink data attributes and initialize a struct nft_data. 4513 * The type and length of data are returned in the data description. 4514 * 4515 * The caller can indicate that it only wants to accept data of type 4516 * NFT_DATA_VALUE by passing NULL for the ctx argument. 4517 */ 4518 int nft_data_init(const struct nft_ctx *ctx, 4519 struct nft_data *data, unsigned int size, 4520 struct nft_data_desc *desc, const struct nlattr *nla) 4521 { 4522 struct nlattr *tb[NFTA_DATA_MAX + 1]; 4523 int err; 4524 4525 err = nla_parse_nested(tb, NFTA_DATA_MAX, nla, nft_data_policy); 4526 if (err < 0) 4527 return err; 4528 4529 if (tb[NFTA_DATA_VALUE]) 4530 return nft_value_init(ctx, data, size, desc, 4531 tb[NFTA_DATA_VALUE]); 4532 if (tb[NFTA_DATA_VERDICT] && ctx != NULL) 4533 return nft_verdict_init(ctx, data, desc, tb[NFTA_DATA_VERDICT]); 4534 return -EINVAL; 4535 } 4536 EXPORT_SYMBOL_GPL(nft_data_init); 4537 4538 /** 4539 * nft_data_uninit - release a nft_data item 4540 * 4541 * @data: struct nft_data to release 4542 * @type: type of data 4543 * 4544 * Release a nft_data item. NFT_DATA_VALUE types can be silently discarded, 4545 * all others need to be released by calling this function. 4546 */ 4547 void nft_data_uninit(const struct nft_data *data, enum nft_data_types type) 4548 { 4549 if (type < NFT_DATA_VERDICT) 4550 return; 4551 switch (type) { 4552 case NFT_DATA_VERDICT: 4553 return nft_verdict_uninit(data); 4554 default: 4555 WARN_ON(1); 4556 } 4557 } 4558 EXPORT_SYMBOL_GPL(nft_data_uninit); 4559 4560 int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data, 4561 enum nft_data_types type, unsigned int len) 4562 { 4563 struct nlattr *nest; 4564 int err; 4565 4566 nest = nla_nest_start(skb, attr); 4567 if (nest == NULL) 4568 return -1; 4569 4570 switch (type) { 4571 case NFT_DATA_VALUE: 4572 err = nft_value_dump(skb, data, len); 4573 break; 4574 case NFT_DATA_VERDICT: 4575 err = nft_verdict_dump(skb, data); 4576 break; 4577 default: 4578 err = -EINVAL; 4579 WARN_ON(1); 4580 } 4581 4582 nla_nest_end(skb, nest); 4583 return err; 4584 } 4585 EXPORT_SYMBOL_GPL(nft_data_dump); 4586 4587 static int nf_tables_init_net(struct net *net) 4588 { 4589 INIT_LIST_HEAD(&net->nft.af_info); 4590 INIT_LIST_HEAD(&net->nft.commit_list); 4591 net->nft.base_seq = 1; 4592 return 0; 4593 } 4594 4595 static struct pernet_operations nf_tables_net_ops = { 4596 .init = nf_tables_init_net, 4597 }; 4598 4599 static int __init nf_tables_module_init(void) 4600 { 4601 int err; 4602 4603 info = kmalloc(sizeof(struct nft_expr_info) * NFT_RULE_MAXEXPRS, 4604 GFP_KERNEL); 4605 if (info == NULL) { 4606 err = -ENOMEM; 4607 goto err1; 4608 } 4609 4610 err = nf_tables_core_module_init(); 4611 if (err < 0) 4612 goto err2; 4613 4614 err = nfnetlink_subsys_register(&nf_tables_subsys); 4615 if (err < 0) 4616 goto err3; 4617 4618 pr_info("nf_tables: (c) 2007-2009 Patrick McHardy <kaber@trash.net>\n"); 4619 return register_pernet_subsys(&nf_tables_net_ops); 4620 err3: 4621 nf_tables_core_module_exit(); 4622 err2: 4623 kfree(info); 4624 err1: 4625 return err; 4626 } 4627 4628 static void __exit nf_tables_module_exit(void) 4629 { 4630 unregister_pernet_subsys(&nf_tables_net_ops); 4631 nfnetlink_subsys_unregister(&nf_tables_subsys); 4632 rcu_barrier(); 4633 nf_tables_core_module_exit(); 4634 kfree(info); 4635 } 4636 4637 module_init(nf_tables_module_init); 4638 module_exit(nf_tables_module_exit); 4639 4640 MODULE_LICENSE("GPL"); 4641 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>"); 4642 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFTABLES); 4643